UnauthorizedAccessException消耗了需要访问令牌的API

Question

I'm developing an .netcore 1.1 MVC app, which is an Open ID Connect client using authorisation with IdentityServer4. It also consumes an API that requires authorisation.

Currently, when the access token expires and a call is made to the API, I am experiencing an System.UnauthorizedAccessException 'attempted to perform an unauthorized operation'.

I cannot seem to figure out how to fix it.

This is how the client is configured (note the API is added to the Scope):

In the Startup.cs, I have registered the API I want to consume, as follows:

app.UseOpenIdConnectAuthentication(new OpenIdConnectOptions()
       {
           AuthenticationScheme = "oidc",
                SignInScheme = CookieAuthenticationDefaults.AuthenticationScheme,
                Authority = identityServerServiceOptions.GetValue<string>("AuthorityUrl"),
                RequireHttpsMetadata = false,
                ResponseType = OpenIdConnectResponseType.CodeIdToken,
                ClientId = identityServerServiceOptions.GetValue<string>("ClientId"),
                ClientSecret = identityServerServiceOptions.GetValue<string>("ClientSecret"),
                GetClaimsFromUserInfoEndpoint = true,
                TokenValidationParameters = new TokenValidationParameters
                {
                    ValidateIssuer = true,
                    NameClaimType = "name",
                    RoleClaimType = "role"
                },
                SaveTokens = true,

                Scope =
                {
                    "[APIName]",
                    "roles",
                    "offline_access"
                }
            });

The client has the following Scopes defined in the IdentityServer4 table 'ClientScopes':

• roles
• email
• profile
• openid
• offline_access
• [APIName]

Also, [APIName] was added tot ApiResources, ApiClaims and ApiScopes.

I already tried:

• Setting AllowOfflineAccess in Clients to 'true'
• Setting UpdateAccessTokenClaimsOnRefresh in Clients to 'true'

Answer 1

如果您的访问令牌过期，则需要使用您在登录期间获得的刷新令牌来续订。