I have this config in IdentityServer:
public static IEnumerable<ApiResource> ApiResources =>
new ApiResource[]
{
new ApiResource
{
Name = "MyApi"
}
};
and this jwt configuration on the ASP.NET Core web API:
services.AddAuthentication("Bearer")
.AddJwtBearer("Bearer", options =>
{
//identity server
options.Authority = "https://localhost:5001";
//access token recepient
options.Audience = "https://localhost:5001/resources";
options.TokenValidationParameters = new TokenValidationParameters
{
ValidateAudience = true,
ValidateLifetime = true,
};
});
I'm expecting that the Web API authentication won't accept the token from IdentityServer because the Web API JwtBearerOption.Audience is not equal to "MyApi". But in my config the Audience is only validated if the audience is set to "https://localhost:5001/resources" and will invalidate if I set it to "MyApi"