WebAPI Secured with Azure AD Authentication not working on IIS but working fine on IIS Express using Visual Studio

Question

I am working on a AnguarJS SPA application calling with an Asp.Net WebAPI.

I have registered both the Client as well as the Backend Application on the Azure AD.

My Client/Web Application is registered with the following details:

1. Sign On URL: http://localhost:93
2. APP ID URL : http://xyz.onmicrosoft.com/XYZLocalClient
3. ClientID: 34A721C3-20E4-41D5-9BC1-486A99BF7C26
4. Reply URL: http://localhost:93

I have given the permissions to other applications (delegated permission) for the client app to access the WebAPI (LocalWebAPI).

My WebAPI has the following setup:

1. It is using the OWIN Middleware with the startup.cs file as:

   public class Startup { public void Configuration(IAppBuilder app) { ConfigureAuth(app); }

   private void ConfigureAuth(IAppBuilder app)
   {
       var azureADBearerAuthOptions = new 
           WindowsAzureActiveDirectoryBearerAuthenticationOptions
       {
           Tenant = ConfigurationManager.AppSettings["ida:Tenant"]
       };
   
       azureADBearerAuthOptions.TokenValidationParameters =
           new System.IdentityModel.Tokens.TokenValidationParameters()
           {
               ValidAudience = 
               ConfigurationManager.AppSettings["ida:Audience"]
           };
   

   app.UseWindowsAzureActiveDirectoryBearerAuthentication (azureADBearerAuthOptions); }

2. It is registered on the Azure AD with the following parameters:

SIGN-ON URL: http://localhost:93/Api/V1/ APP ID URI: https://xyz.onmicrosoft.com/LocalCognia Reply URLs: http://localhost:93/Api/V1/*

My Web.Config file is:

<add key="owin:AutomaticAppStartup" value="true"/>
<add key="ida:Tenant" value="xyz.onmicrosoft.com" />
<add key="ida:Audience" value="34A721C3-20E4-41D5-9BC1-486A99BF7C26" />

I have also decorated my controller with the [Authorize] Attribute.

Everything seems to be working fine. I am able to authenticate the user and able to access the resources from the WebAPI when I run my application from the Visual Studio 2015 environment (IIS Express).

But as soon as I deploy my application on the IIS Server, using the same parameters, (expect that the application is now on localhost:8087 and with the reply URL for the client app as: localhost:8087), I am getting error as 401: UnAuthroized user on calling the WebAPI.

I am getting the token in the Headers for the WebAPI call, but still getting the error. Not sure of this behavior. Can someone please help on this?

Answer 1

Please use below code in your ConfigureAuth :

app.UseWindowsAzureActiveDirectoryBearerAuthentication(
new WindowsAzureActiveDirectoryBearerAuthenticationOptions
{
    Tenant = ConfigurationManager.AppSettings["ida:Tenant"],
    TokenValidationParameters = new TokenValidationParameters
    {
        ValidAudience = ConfigurationManager.AppSettings["ida:Audience"]
    },
});