Challenging multiple authentication schemes in Asp.Net Core 2.0 with a default policy on all actions

configure-identity.cs

services.AddIdentity<AppUser, AppRole>();
services.AddAuthentication()
        .AddIdentityServerAuthentication(o =>
        {
            o.RequireHttpsMetadata = !environment.IsDevelopment();
            o.ApiName = "api";
            o.Authority = configuration["IdentityServer:Authority"];
        });

configure-policy.cs

services.AddMvc(options =>
        {
            // The default policy is to make sure that both authentication schemes - Cookie and Jwt - are challenged
            var defaultPolicy = new AuthorizationPolicyBuilder(IdentityConstants.ApplicationScheme, "Bearer")
                .RequireAssertion(c => true) // A requirement is mandatory
                .Build();
            options.Filters.Add(new AuthorizeFilter(defaultPolicy));
        })