Web Api Odata Function/Action with Bearer token fails

I have a web api Odata service that has token based OAuth 2 implemented and working except when I try to call an Odata Action or function in the format of GET /odata/myentity/MyNameSpace.MyFunction(). The functions work fine when not using token auth.

In a Bearer token request to a normal endpoint I can get a ClaimsIndentity like this: actionContext.Request.GetRequestContext().Principal?.Identity as ClaimsIdentity;

As soon as I change the request to a function or action call the actionContext.Request.GetRequestContext().Principal is always null. I can however still see the same Authorization header in the request as I did in a working endpoint call.

I do not see any config options in the OAuth/Owin setup that seem to have anything to do with allowing or not allowing calls specifically to actions or functions. This feels like a bug to me. Has anyone else ever run across this?