挥舞着“此请求的授权已被拒绝”消息

Question

In my Swagger API I am getting this message constantly even when it picks up the Api-Key specified in the header,Why is this occuring? any help would be great

Request URL

https://localhost:44338/api/Accounts/CreateRole?api_key=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1bmlxdWVfbmFtZSI6ImRhdGFseXR5eCIsInJvbGUiOiJTeXN0ZW1BZG1pbmlzdHJhdG9yIiwiaXNzIjoiRnJhbmtIaXJ0aCIsImF1ZCI6IkNsaWVudEFjY2VzcyIsImV4cCI6MTUyODMyMDI4NX0.w6eYfa4YSyJEwqVovdBUhQJkuHDf1IvG-YZk1rf6SVU

Response Body

{ "message": "Authorization has been denied for this request." }

Startup.cs

[assembly: OwinStartup(typeof(ProjectScavengerAPI.Web.Startup))]

namespace ProjectScavengerAPI.Web
{
public partial class Startup
{
    public void Configuration(IAppBuilder app)
    {
        app.UseCors(Microsoft.Owin.Cors.CorsOptions.AllowAll);
        this.ConfigureOAuthTokenConsumption(app);
        HttpConfiguration config = new HttpConfiguration();
        config.Formatters.JsonFormatter.SerializerSettings.ContractResolver = new CamelCasePropertyNamesContractResolver();
        config.Formatters.JsonFormatter.UseDataContractJsonSerializer = false;
        config.IncludeErrorDetailPolicy = IncludeErrorDetailPolicy.Always;

        WebApiConfig.Register(config);
        app.UseWebApi(config);
    }
}
}

WebApiConfig

        public static void Register(HttpConfiguration config)
    {
        // Web API configuration and services
        config.SuppressDefaultHostAuthentication();
        config.Filters.Add(new HostAuthenticationFilter(OAuthDefaults.AuthenticationType));
        // Web API routes
        config.MapHttpAttributeRoutes();

        config.Routes.MapHttpRoute(
            name: "DefaultApi",
            routeTemplate: "api/{controller}/{action}/{id}",
            defaults: new { id = RouteParameter.Optional }
        );
    }

Startup_Auth

    public partial class Startup
{
    // For more information on configuring authentication, please visit https://go.microsoft.com/fwlink/?LinkId=301864
    public static OAuthAuthorizationServerOptions OAuthOptions { get; private set; }

    public static string PublicClientId { get; private set; }

    private void ConfigureOAuthTokenConsumption(IAppBuilder app)
    {
        var issuer = ConfigurationManager.AppSettings["Issuer"];
        var audienceId = ConfigurationManager.AppSettings["AudienceId"];
        var clientAudienceId = ConfigurationManager.AppSettings["ClientAudienceId"];
        var audienceSecret = ConfigurationManager.AppSettings["AudienceSecret"];

        // Api controllers with an [Authorize] attribute will be validated with JWT
        app.UseJwtBearerAuthentication(new JwtBearerAuthenticationOptions
        {
            AuthenticationMode = AuthenticationMode.Active,
            AllowedAudiences = new[] { audienceId, clientAudienceId },
            IssuerSecurityTokenProviders = new IIssuerSecurityTokenProvider[]
            {
                new SymmetricKeyIssuerSecurityTokenProvider(issuer, audienceSecret)
            }
        });
    }
}

CreateRole Function (SystemAdministrator already exists)

    [HttpPost]
    [Authorize(Roles = "SystemAdministrator")]
    [Route("CreateRole")]
    public IHttpActionResult CreateRole(string roleName)
    {
        return TryAction(() => _CreateRole(roleName));
    }
    private object _CreateRole(string roleName)
    {
        try
        {
            if (!Roles.RoleExists(roleName))
            {
                Roles.CreateRole(roleName);
            }
            return $"{roleName} created";
        }
        catch
        {
            if (Roles.RoleExists(roleName))
            {
                return $"{roleName} exists";
            }
        }

        return "";
    }

Postman Response working

Answer 1

After spending hours trying to figure out why it wasn't working it turns out I had a spelling error while injecting the javascript file that appends "bearer" to the token so it was never being injected.

I also had to add ApiKeySupport in the SwaggerConfig.EnableSwaggerUI

 .EnableSwaggerUi(c =>
                {

                    c.InjectJavaScript(thisAssembly, "ProjectScavengerAPI.Web.Scripts.Swagger.jwt-auth.js");
                    c.EnableApiKeySupport("Authorization", "header");
                                        });