How to Access MVC API which is authorize with IdentityServer4

Question

On Owin middleware Startup class I have added OIDC Authentication where response type is "code id_token". With this middleware I can access my authorized controller. But the problem is, I can't access my API in the same domain with this middleware.

I am using the access_token that i stored in the userClaim. But it is returning the HTML of IdentityServer4 login page.

    [Filters.AuthorizeOIDC(Roles = "dukkan.sa")]
    public async Task<ActionResult> ViewApiResult()
    {
        var user = User as System.Security.Claims.ClaimsPrincipal;
        var token = user.FindFirst("access_token").Value;
        var result = await CallApi(token);

        ViewBag.Json = result;
        return View();
    }

    private async Task<string> CallApi(string token)
    {
        var client = new HttpClient();
        client.SetBearerToken(token);

        var json = await client.GetStringAsync("http://localhost:57346/api/SampleApi");
        return json;
    }

The examples I got to secure MVC API is with IdentityServer3. They are using IdentityServer3.AccessTokenValidation package to authenticate the client from back channel during the API Access request:

app.UseOAuthBearerAuthentication(new IdentityServerBearerTokenAuthenticationOptions { Authority = "https://localhost:44319/identity", RequiredScopes = new[] { "sampleApi" } });

But IdentityServer4.AccessTokenValidation is not working with MVC5. I can use IdentityServer3.AccessTokenValidation in MVC 5. But this is accepting IdentityModel with version bellow 2.0.0.

Need solution for it. IdentityServer4 is not supporting properly for MVC.

hi, @RuardvanElburg, currently i have converted my MVC webAPI2 to .net Core 2 to authenticate it with IdentityServer4. Later on I'll try it again by making my full project in .net 4.5 in a fresh solution instead of current .net v4.6.2. — Debashis Chowdhury

Ruard van Elburg Ruard van Elburg · Accepted Answer · 2018-10-17T19:34:29

Why do you want to use IdentityServer4.AccessTokenValidation with MVC5? Because the server is IdentityServer4?

There is no need for that. IdentityServer3 and IdentityServer4 are build on the same OpenId Connect specifications, meaning that you can use IdentityServer3.AccessTokenValidation for the client while the server is IdentityServer4.

In fact you can use any piece of code on the client that is build according to the specifications of OpenId Connect. I suggest you give IdentityServer3.AccessTokenValidation a try.

How to Access MVC API which is authorize with IdentityServer4

1 Answers