How to consume a JWT Token ASP.NET MVC

Question

Sorry, it's a long message but it's to be clear (I hope) I have followed this article to set up an AuthorizationServerProvider and let anyone, who has a JWT Token, to call a certain API in my code. BUT, when I try to invoke any controller or API Controller method of my MVC Project, I get an Unauthorized message.

This is When I Request the Token (Updated)

This is when I try to Invoke a Method with [authorize attribute]

This is The Payload

Here are my ValidateClientAuthentication and GrantResourceOwnerCredentials method:

using Microsoft.AspNet.Identity.Owin;
using Microsoft.Owin.Security.OAuth;
using System.Security.Claims;
using System.Threading.Tasks;
using MyProject.Models;
using Microsoft.Owin.Security;

public class AuthorizationServerProvider : OAuthAuthorizationServerProvider
{
    public override async Task ValidateClientAuthentication(OAuthValidateClientAuthenticationContext context)
    {
            context.Validated();
        
    }
    public override async Task GrantResourceOwnerCredentials(OAuthGrantResourceOwnerCredentialsContext context)
    {
        var allowedOrigin = "*";
        //
        context.OwinContext.Response.Headers.Add("Access-Control-Allow-Origin", new[] { allowedOrigin });

        var userManager = context.OwinContext.GetUserManager();
        
        ApplicationUser user = await userManager.FindAsync(context.UserName, context.Password);
        if (user == null)
        {
            context.SetError("invalid_grant", "The user name or password is incorrect.");
            return;
        }

        ClaimsIdentity oAuthIdentity = await user.GenerateUserIdentityAsync(userManager, "JWT"); // maybe this is the problem
        // oAuthIdentity.AddClaim(new Claim(ClaimTypes.Role, "User"));
        // oAuthIdentity.AddClaim(new Claim(ClaimTypes.Authentication, "AudienceID"));
        var ticket = new AuthenticationTicket(oAuthIdentity, null);
        context.Validated(ticket);
    }
}

In my Startup.Auth.cs I have put two methods to let that Api controllers with an [Authorize] attribute can be validated with JWT. Here the partial class:

using Microsoft.AspNet.Identity.EntityFramework;
using Microsoft.AspNet.Identity.Owin;
using Microsoft.IdentityModel.Tokens;
using Microsoft.Owin.Security.OAuth;
using System;
using System.IdentityModel.Tokens.Jwt;
using System.Security.Claims;
using System.Threading.Tasks;

public partial class Startup
{
    public void ConfigureAuth(IAppBuilder app)
    {
        app.CreatePerOwinContext(ApplicationDbContext.Create);
        app.CreatePerOwinContext(ApplicationUserManager.Create);
        app.CreatePerOwinContext(ApplicationSignInManager.Create);
        
        ConfigureOAuthTokenGeneration(app);
        ConfigureOAuthTokenConsumption(app);
        
        app.UseCookieAuthentication(new CookieAuthenticationOptions
         {
             AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
             LoginPath = new PathString("/Account/Login"),
             Provider = new CookieAuthenticationProvider
             {  
                 OnValidateIdentity = SecurityStampValidator.OnValidateIdentity(
                     validateInterval: TimeSpan.FromMinutes(10),
                     regenerateIdentity: (manager, user) => user.GenerateUserIdentityAsync(manager))
             }
         });    
        /*Other Types of Authentication*/        
        app.UseExternalSignInCookie(DefaultAuthenticationTypes.ExternalCookie);
        app.UseTwoFactorSignInCookie(DefaultAuthenticationTypes.TwoFactorCookie, TimeSpan.FromMinutes(5));
        app.UseTwoFactorRememberBrowserCookie(DefaultAuthenticationTypes.TwoFactorRememberBrowserCookie);
    }

    private void ConfigureOAuthTokenGeneration(IAppBuilder app)
    {
        OAuthAuthorizationServerOptions OAuthServerOptions = new OAuthAuthorizationServerOptions()
        {
            //For Dev enviroment only (on production should be AllowInsecureHttp = false)
            AllowInsecureHttp = true,
            TokenEndpointPath = new PathString("/oauth/token"),
            AccessTokenExpireTimeSpan = TimeSpan.FromMinutes(3),
            Provider = new AuthorizationServerProvider(),
            AccessTokenFormat = new CustomJwtFormat("https://localhost:44391")
        };
        app.UseOAuthAuthorizationServer(OAuthServerOptions);
    }

    private void ConfigureOAuthTokenConsumption(IAppBuilder app)
    {
        var issuer = "https://localhost:44391";
        string audienceId = ConfigurationManager.AppSettings["AudienceID"]; //its value is "AudienceID"
        byte[] audienceSecret = TextEncodings.Base64Url.Decode(ConfigurationManager.AppSettings["SecretKey"]);
        string[] AllowedAud = new[] { audienceId };
        // Api controllers with an [Authorize] attribute will be validated with JWT
        app.UseJwtBearerAuthentication(
            new JwtBearerAuthenticationOptions
            {
                AuthenticationMode = AuthenticationMode.Active,
                AllowedAudiences = AllowedAud,
                // IssuerSecurityTokenProviders = new IIssuerSecurityTokenProvider[],
                IssuerSecurityKeyProviders = new IIssuerSecurityKeyProvider[]
                {
                    new SymmetricKeyIssuerSecurityKeyProvider(issuer, audienceSecret)
                }
            }) ;
    }
}

I invoke these methods in ConfigureAuth(IAppBuilder app). So after all this, I can't understand why I am not able to be authorized. Any Idea?

If this can help: I am using Microsoft.Owin:Security.Jwt v4.1.1

I generate The token with this method:

using Microsoft.Owin.Security;
using System;
using System.Configuration;
using System.IdentityModel.Tokens.Jwt;
using System.Security.Claims;
using Microsoft.IdentityModel.Tokens;

public class CustomJwtFormat : ISecureDataFormat
{
    private readonly string _issuer = string.Empty;

    public CustomJwtFormat(string issuer)
    {
        _issuer = issuer;
    }

    /*This Generate JWT*/
    public string Protect(AuthenticationTicket data)
    {
        if (data == null)
        {
            throw new ArgumentNullException("data");
        }
        string username = data.Identity.Name;
        string audienceId = ConfigurationManager.AppSettings["AudienceID"]; // "AudienceID"

        string symmetricKeyAsBase64 = ConfigurationManager.AppSettings["SecretKey"];
        
        var keyByteArray = Convert.FromBase64String(symmetricKeyAsBase64);
        
        var issued = data.Properties.IssuedUtc;
        
        var expires = data.Properties.ExpiresUtc;
        
        var securityKey = new SymmetricSecurityKey(keyByteArray);
        
        var signingCredentials = new SigningCredentials(securityKey, algorithm: SecurityAlgorithms.HmacSha256Signature);

        var token = new JwtSecurityToken(issuer:_issuer, audience: audienceId, data.Identity.Claims, issued.Value.UtcDateTime, expires.Value.UtcDateTime, signingCredentials) ;
        
        var handler = new JwtSecurityTokenHandler();
        
        var jwt = handler.WriteToken(token);

        return jwt;
    }

    public AuthenticationTicket Unprotect(string protectedText)
    {
        throw new NotImplementedException();
    }
}

This is The StartUp

using Microsoft.Owin;
using Owin;
using System.Web.Http;

[assembly: OwinStartupAttribute(typeof(MyProject.Startup))]
namespace MyProject
{
    public partial class Startup
    {
        public void Configuration(IAppBuilder app)
        {
            ConfigureAuth(app);
            var config = new HttpConfiguration();
            WebApiConfig.Register(config);
            app.UseWebApi(config);
        }
    }
}

How to consume a JWT Token ASP.NET MVC

Answers (1)

Related Questions