IdentityServer / IdentityServer3.AccessTokenValidation

OWIN Middleware to validate access tokens from IdentityServer3
Apache License 2.0
91 stars 149 forks source link

How to Use This along with other Authentication Middlewares? #107

Closed randalvance closed 7 years ago

randalvance commented 7 years ago

I am trying to authenticate a request using either Google or my Identity Server. I want a user to login using a token from Id server 4, or from Google. However, I can't figure out how to use both authentication middlewares. If I pass the id_token for google, it passes on the first middleware (UseJwtBearerAuthentication) but fails on the second one (UseIdentityServerAuthentication). How can I make it so that it doesn't throw error when it actually passes on at least 1 authentication middleware? For example, if it passes on the first middleware, the second middleware is ignored? Do I need to create a custom one that checks if user is already authenticated? Am I missing a property that I should set for both middleware options? Thanks.

app.UseJwtBearerAuthentication(new JwtBearerOptions()
{
    Authority = "https://accounts.google.com",
    Audience = "secret.apps.googleusercontent.com",
    TokenValidationParameters = new TokenValidationParameters()
    {
        ValidateAudience = true,
        ValidIssuer = "accounts.google.com"
    },
    RequireHttpsMetadata = false
});

app.UseIdentityServerAuthentication(new IdentityServerAuthenticationOptions
{
    Authority = "http://localhost:1000/",
    RequireHttpsMetadata = false,

    ScopeName = "MyApp.Api"
});
leastprivilege commented 7 years ago

I am confused..

is this an API?

Why would you use Google's identity token to authenticate with it?

What do you means with "it fails" ?

leastprivilege commented 7 years ago

This also looks like it is ASP.NET Core - so this is the wrong repo.