Closed piotrekbigu closed 6 years ago
No. id_tokens are for the client. access_tokens are for the API. Your client needs to obtain an access token to invoke the API on behalf of the user.
But in validation middleware I found code which recognizes JWT format (dot separator). For which cases is it implemented?
Not all JWTs are access tokens.
Ok. So if I good understood I missed some element which points that my JWT token is also a access token?
You need to learn a bit more about the OIDC and OAUth2 protocols, I think. Check our docs for links to the specs.
Thank you for help :)
Hello again, to be honest I have been sitting and reading the whole documentation for the month. Is it possible to aquip me with a tip which document (RFC, IdentityServer docs, any other resource) should I read again.
Oh except that is for ASP.NET COre. I don't have anything like it for Katana, but at least the high level should help.
Finally I found the solution :) It was a bug at client level - I was passing id_token instead of an access_token to my resource server.
Thank you for help.
Btw. awesome presentation :)
Hi, This is not an issue but a general qeustion about API.
I successfully implemented IdentityServer and Resource Server. I am able to create identity and access tokens and access protected resource using access tokens. Today I tried to call resource server and pass in authorization header created JWT token but I got http 401 response. I am sure that token was valid, because when I used access token created at the same moment authoirization passed successfully.
Is it possible to use identity token during access to resource server? I looked into your source and examples code and it looks like it should be possible.
I will be very grateful for any explanation/tip.