search

IdentityServer / IdentityServer3.AccessTokenValidation

OWIN Middleware to validate access tokens from IdentityServer3
Apache License 2.0
90 stars 150 forks source link

Set audience to the resource I want to use #130

Closed mrochon closed 7 years ago

mrochon commented 7 years ago

As per https://github.com/IdentityServer/IdentityServer3.AccessTokenValidation/issues/8 audience seems to be always set to issuer+/resource. However, per JWT specs (as I understand them) my access token should have an aud claim that identifies the resource I am providing the token to. Is there a way to configure IS with a list of valid audiences (per client) and include the appropriate aud claim in the token?

leastprivilege commented 7 years ago

You use the scope claim to specify the exact API this token is for.

mrochon commented 7 years ago

Yes, but that still does not change my aud claim in the token and so the validation will fail unless every API app uses the same audience id.

leastprivilege commented 7 years ago

Yes - in OAuth scopes are used. Aud is a JWT implementation detail.

That's the way it is in IdentityServer3.

mrochon commented 7 years ago

OK. Thanks.

UlyssesAlves commented 7 years ago

Do you guys have a code example of how to accomplish this?