Please tell me why I can not add any scope to OpenIdConnectOptions? It doesn't work with an ASP.NET Core MVC client, but with a js client it works fine!
My code...
IdentityServer4 Client registration
public static IEnumerable<Client> GetClients()
{
return new List<Client>
{
new Client
{
ClientId = "web",
ClientName = "Web Client",
AllowedGrantTypes = GrantTypes.Implicit,
AllowAccessTokensViaBrowser = true,
AlwaysIncludeUserClaimsInIdToken = true,
RedirectUris = {"http://localhost:5002/signin-oidc"},
PostLogoutRedirectUris = {"http://localhost:5002/signout-callback-oidc"},
AllowedCorsOrigins = {"http://localhost:5002"},
AllowedScopes =
{
IdentityServerConstants.StandardScopes.OpenId,
IdentityServerConstants.StandardScopes.Profile,
"api1"
},
AccessTokenLifetime = 300,
IdentityTokenLifetime = 3600,
AllowOfflineAccess = true,
}
};
}
Next, I add code to the mvc client to use authorization.
Mvc client
JwtSecurityTokenHandler.DefaultInboundClaimTypeMap.Clear();
services.AddAuthorization(options =>
options.AddPolicy("AdminsOnly", policyUser =>
{ policyUser.RequireClaim("role", "admin"); }));
services.AddAuthentication(options =>
{
options.DefaultScheme = "Cookies";
options.DefaultChallengeScheme = "oidc";
})
.AddCookie("Cookies")
.AddOpenIdConnect("oidc", options =>
{
options.SignInScheme = "Cookies";
options.Authority = "http://localhost:5000";
options.RequireHttpsMetadata = false;
options.GetClaimsFromUserInfoEndpoint = true;
options.Scope.Add("api1");
options.ClientId = "web";
options.SaveTokens = true;
});
When I try to switch to an action marked with the [authorize] attribute, I get an error
Sorry, there was an error : invalid_scope.
If I delete the line options.Scope.Add("api 1"); then the authentication works. But in this case I can not specify roles and more...
The project can be downloaded here