Access Token Validation in Web API 2 Framework 4.x with Identity Server 4

user_4932573 0
Viewed 1208

Hopefully someone can point me in the right direction, I need to validate the access token issued by identity server 4 in my api.

Authorized attribute is already set in the API.

Access token is retrieved correctly from server, but when passsing the access token to the request, i got an 401 Unauthorized error, and nothing is processed the request is rejected. I am using IdentityServer3.AccessTokenValidation nuget package.

I noticed for v4 of the AccessTokenValidation you can set RequireHttpsMetadata = false but i dont see how in v3.

Is this the best way to do this or should i be looking into another direction ?

public void ConfigureAuth(IAppBuilder app)
{

    app.UseCookieAuthentication(new CookieAuthenticationOptions
    {
        AuthenticationType = "Cookies",
    });

    JwtSecurityTokenHandler.InboundClaimTypeMap = new Dictionary<string, 
    string> 
    ();

    app.UseIdentityServerBearerTokenAuthentication
    (new IdentityServerBearerTokenAuthenticationOptions
    {
        Authority = "http://localhost:5000",
        RequiredScopes = new[] { "api2" },
    });
}

Thanks

identityserver3 asp.net-web-api2 identityserver4 oauth-2.0
1 Answers

You need to remove UseCookieAuthentication and just use UseIdentityServerBearerTokenAuthentication.

using section 

using System.IdentityModel.Tokens.Jwt;
using IdentityServer3.AccessTokenValidation;
using Microsoft.Owin;
using Owin;
using System.Net;

Below configuration works with me using .Net 4.7 and dentityServer3.Contrib.AccessTokenValidation nuget package

public void ConfigureAuth(IAppBuilder app)
{
    JwtSecurityTokenHandler.DefaultInboundClaimFilter.Clear();
    JwtSecurityTokenHandler.DefaultInboundClaimTypeMap.Clear();
    JwtSecurityTokenHandler.DefaultOutboundClaimTypeMap.Clear();

    app.UseIdentityServerBearerTokenAuthentication(new IdentityServerBearerTokenAuthenticationOptions
    {
        Authority = "http://localhost:5000",
        RequireHttps = false, // For development
        RequiredScopes = new List<string> { "openid", "profile", "address", "roles", "offline_access" },            
    });
}

Used nuget packages

Install-Package IdentityModel -Version 3.10.10
Install-Package IdentityServer3.Contrib.AccessTokenValidation -Version 4.0.36
Install-Package Microsoft.IdentityModel.Tokens -Version 5.3.0
Install-Package System.IdentityModel.Tokens.Jwt -Version 5.3.0
Install-Package Microsoft.IdentityModel.Protocols.OpenIdConnect -Version 5.3.0
Install-Package Microsoft.IdentityModel.Protocols -Version 5.3.0
Install-Package Microsoft.IdentityModel.Logging -Version 5.3.0
Install-Package Microsoft.IdentityModel.JsonWebTokens -Version 5.3.0
user_31341120
Related