RolandGuijt
commented
3 days ago This isn't an IdentityServer issue. It is about the configuration of an OWIN API which is not our product.
Having said that: why does the API has cookie authentication configured? If the cookie scheme is the default authentication scheme the API will expect a valid session cookie and ignore the token. Just configuring bearer token authentication should be enough. You can also look at our example that shows how to configure the OWIN API.
Which version of Duende IdentityServer are you using? Identity server 7.0.4
Which version of .NET are you using? Client - Angular Application, Identity server - .Net Core 8 & Web API - .Net Framework 4.8
Describe the bug Angular client application successfully connects to the Identity server and receives the access token, but when I pass the access token to Web API which is developed in .Net Framework it is throwing out the error "message": "Authorization has been denied for this request."
A clear and concise description of what the bug is. "message": "Authorization has been denied for this request."
To Reproduce
Steps to reproduce the behavior. I used the below code in the web api developed in .Net Framework.
app.UseCookieAuthentication(new CookieAuthenticationOptions()); app.UseExternalSignInCookie(DefaultAuthenticationTypes.ExternalCookie); var options = new IdentityServerBearerTokenAuthenticationOptions { Authority = ConfigurationManager.AppSettings["IDPAuthorityUrl"].ToString(), AuthenticationType = "Bearer", RequiredScopes = new [] { "benefitplanApi" }, ClientId = "benefitplan"
}; app.UseIdentityServerBearerTokenAuthentication(options);
Expected behavior Should be able to authorize the token.
A clear and concise description of what you expected to happen.
Log output/exception with stacktrace "message": "Authorization has been denied for this request."
Additional context
Add any other context about the problem here.