Multiple JWT bearers for authorization and authentication

Question

I have a .NET Core IdentityServer (IS) for SSO, which I want to use for authentication of my .NET Core(backend)-Angular (client) app. I want to have an EF ApplicationUser on the backend and Claim based authorization on the backend via a custom backend-generated JWT token which will also work for authorization on the client .

On the backend, I created a middleware to check "Authorization" header on all requests. If the header contains a token generated by the IS I want to swap it for a custom (backend-)generated token which contains necessary claims. The client then uses this header for subsequent requests to backend.

startup configuration:

public void Configure(IApplicationBuilder app, IHostingEnvironment env)
{
   app.UseMiddleware<AuthorizationHeaderMiddleware>();
   app.UseAuthentication();
   app.UseStaticFiles();
   app.UseMvc();
}

public void ConfigureServices(IServiceCollection services)
{
   services.AddAuthentication(DEFAULT_AUTH_SCHEME)
        .AddJwtBearer(DEFAULT_AUTH_SCHEME, cfg =>
          {
                cfg.Audience = Configuration["Authorization:JwtIssuer"];
                cfg.RequireHttpsMetadata = false;
                cfg.TokenValidationParameters = new TokenValidationParameters
                    {
                    RequireSignedTokens = false,
                    ValidateIssuer = false,
                    ValidateLifetime = false,
                    ValidateIssuerSigningKey = false,
                    ValidIssuer = Configuration["Authorization:JwtIssuer"],
                    ValidAudience = Configuration["Authorization:JwtIssuer"],
                    IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(Configuration["Authorization:JwtKey"])),
                    RequireExpirationTime = false,
                    ClockSkew = TimeSpan.Zero // remove delay of token when expire
                };
          })
       .AddIdentityServerAuthentication(JwtBearerDefaults.AuthenticationScheme, options =>
             {
                 options.Authority = Configuration["IdentityServer:Url"];
                 options.RequireHttpsMetadata = false;
                 options.ApiName = Configuration["IdentityServer:ApiName"];
                 options.SupportedTokens = SupportedTokens.Both;
                 options.SaveToken = false;
                 options.EnableCaching = false; 
                 options.CacheDuration = TimeSpan.FromMinutes(10);
             });

    services.AddAuthorization(options =>
        options.AddPolicy("protectedScope", policy =>
        {
            policy.AuthenticationSchemes = new List<string> { DEFAULT_AUTH_SCHEME };
            policy.RequireAuthenticatedUser();
            policy.RequireClaim("someclaim");
        }));
}

AuthorizationHeaderMiddleware.cs:

    public class AuthorizationHeaderMiddleware
    {
        private RequestDelegate _next;
        private readonly IConfiguration _configuration;   

        public AuthorizationHeaderMiddleware(RequestDelegate next, IConfiguration configuration)
        {
            _configuration = configuration;
            _next = next;
        }

        public async Task Invoke(HttpContext context)
        {
            // here I intend to get user from the (backend) DB based on "sub" claim from IdentityServer's token and set users claims from DB. Is this correct attitude?
            var claims = new List<Claim> { new Claim("someclaim", "aaaa") };
            var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(_configuration["Authorization:JwtKey"]));
            var creds = new SigningCredentials(key, SecurityAlgorithms.HmacSha256);
            var token = new JwtSecurityToken(
                _configuration["Authorization:JwtIssuer"],
                _configuration["Authorization:JwtIssuer"],
                claims,
                signingCredentials: creds
            );

            var tokenGenerated = new JwtSecurityTokenHandler().WriteToken(token);
            context.Request.Headers["Authorization"] = $"{DEFAULT_AUTH_SCHEME} {tokenGenerated}";

            await _next.Invoke(context);
        }

TestController.cs

    [Authorize(Policy = "protectedScope", AuthenticationSchemes = DEFAULT_AUTH_SCHEME)]
    public class TestController
    {
        [HttpGet]
        public IActionResult TestAction()
        {
            return Ok();
        }
    }

If I request Test action in TestController I get 401 Unauthorized.

What am I doing wrong here?

This is not a duplicate of Use multiple JWT Bearer Authentication question, as I have tried that answer and it did not work out. Also, it is a different case, as I want to use IdentityServer for authentication an backend JWT for authorization.

Answer 1

You can only have use IdentityServerAuthentication and after a successful authentication add the claims from Application User to Current User. You can do this by using OnTokenValidated

services.AddAuthentication()
        .AddIdentityServerAuthentication(DEFAULT_AUTH_SCHEME, options =>
        {
            options.Authority = Configuration["IdentityServer:Url"];
            options.RequireHttpsMetadata = false;
            options.ApiName = Configuration["IdentityServer:ApiName"];
            options.SupportedTokens = SupportedTokens.Both;
            options.SaveToken = false;
            options.EnableCaching = false;
            options.CacheDuration = TimeSpan.FromMinutes(10);
            options.JwtBearerEvents.OnTokenValidated = async context =>
            {
                // get subject from authenticated principal
                var subject = context.Principal.FindFirst("sub");

                // get claims from your database for the subject
                var claims = new List<Claim> { new Claim("someclaim", "aaaa") };

                // change the principal
                context.Principal = new System.Security.Claims.ClaimsPrincipal(claims);
            };
        });