Why doesn't IdentityServer4 ApiResource work with JwtBearerOption.Audience?

Viewed 877

I have this config in IdentityServer:

public static IEnumerable<ApiResource> ApiResources =>
        new ApiResource[]
        {
            new ApiResource
            {
                Name = "MyApi"
            }
        };

and this jwt configuration on the ASP.NET Core web API:

 services.AddAuthentication("Bearer")
       .AddJwtBearer("Bearer", options =>
       {
           //identity server
           options.Authority = "https://localhost:5001";

           //access token recepient
           options.Audience = "https://localhost:5001/resources";

           options.TokenValidationParameters = new TokenValidationParameters
           {
               ValidateAudience = true,
               ValidateLifetime = true,
           };
       });

I'm expecting that the Web API authentication won't accept the token from IdentityServer because the Web API JwtBearerOption.Audience is not equal to "MyApi". But in my config the Audience is only validated if the audience is set to "https://localhost:5001/resources" and will invalidate if I set it to "MyApi"

IdentityServer4 documentation about related to my question.

1 Answers

To get MyApi into the list of audiences you need to define an ApiScope as will in IdentityServer4 (v4.0x)

See this articles for more details

Related