IdentityServer 4- ASP.net webapi (non core) - Missing ApiResource

Question

Given

I've a identityserver v4 running. A Javascript client creates a token and accesses a asp.core api with the generated accesstoken.

In Asp Core Api I have this code which works

             services.AddAuthentication("Bearer")
            .AddIdentityServerAuthentication(options =>
            {
                options.Authority = authority;
                options.ApiName = "myApi";
            });

In IdentityServer I defined "myApi" as a ApiResource.

Problem

Now I wanted to include another api which is older webapi and written with .net4.6.1 . But all calls to this api end in a 401

Using same request to the core api with same token works.

The code to for the looks like this:

      JwtSecurityTokenHandler.InboundClaimTypeMap.Clear();
      var options = new IdentityServerBearerTokenAuthenticationOptions
        {
            Authority = identServer,
            RequiredScopes = new List<string>
            {
                "myApi"
            }
        };

        app.UseIdentityServerBearerTokenAuthentication(options);

But the tokens that are working the core project doen't work there. One thing i can see is that i can't set a api name in the IdentityServerBearerTokenAuthenticationOptions .

Currently i'm using the IdentityServer3.AccessTokenValidation Nuget package. Maybe thats related to the problem ?

I can't use IdentityServer4.AccessTokenValidation due to some dependency issues there. For example there are only AddOptions for the netcore authentication builders

With jwt.io i also cheked the token and can see t hat myApi is part in aud and in scope

I also tried to set no required scopes still i got 401

Some time ago i tested this with the identity server v3 there it worked.

Also i don't see any Validation errors in the logs. What am I missing to get the errors of the api token validation logged?

What am I missing?

Update When setting the validationmode to the endpoint i got a exception in the identityserver.

fail: IdentityServer4.Validation.ApiSecretValidator[0] No API resource with that name found. aborting fail: IdentityServer4.Endpoints.IntrospectionEndpoint[0] API unauthorized to call introspection endpoint. aborting.

Unfortuenatly it doesn't tell me what the api is he is expected .... As mentioned before "myApi" is defined as ApiResource but how to set the api name in the non core environment ?

Answer 1

It is OK to use IdentityServer3.AccessTokenValidation when authenticating against IDS4, don't worry about that.

Try this:

In the Startup.cs of your .net4.6.1 app, in your IdentityServerBearerTokenAuthenticationOptions there is a property ValidationMode. Set it to ValidationMode.Both and try again.

Answer 2

The reason was that when i authenticate with an non core api, the api ressource needs to have an secret, then the api resource name and secret has to be set in the api.

Here:

In IdentityServer

new ApiResource("myApi", "My Test API")
{   
  ApiSecrets = new List<Secret>()
  {
    new Secret("435tgsdgfdg".Sha256()) // This wasnt required when attaching a .net core api
  }
}

and the configuration in the netfx webapi is then:

var options = new IdentityServerBearerTokenAuthenticationOptions
  {
    ClientId = "myApi",
    ClientSecret = "435tgsdgfdg",
    RequiredScopes = new List<string> { "myApi"},            
    Authority = identtityServerUri,
    DelayLoadMetadata = true
  };

For asp core webapi's there was no need neither for me to set the secret in identityserver nor set clientid and client secret in the client.