身份服务器 4 - API 在部署到服务器时返回 401 Unauthorized

Question

I am using a Blazor Server app authenticating through Identity Server 4 with access to an asp.net core 3.1 API. Locally, I have a set up working using Identity Server on port 5000, API on 5001, and my Blazor App on 5002.

On our test servers we have hosted all three in IIS(Blazor on one server, API and Identity Server on another). I get 401 Unauthorized when accessing an Authorize tagged controller. I am able to login and I know the API is reachable still as not all controllers need authorize and that data comes through. Also, I know there's a token as I have at one point printed it to the page.

What perhaps may be the cause for the API no longer accepting the token generated by Identity Server when in our test environment?

Here is my code examples, will happily add more if needed:

Authorized Controller

[Authorize(AuthenticationSchemes = JwtBearerDefaults.AuthenticationScheme)]
[Route("api/[controller]")]
[ApiController]
public class Controller : ControllerBase

API Resources

public static IEnumerable<ApiResource> Apis =>
  new ApiResource[]
  {
    new ApiResource("Api", "MyApi")

  };

Client Set-up

 public static IEnumerable<Client> Clients =>
        new List<Client>
         {
             //Client
             new Client
            {
                ClientId = "Client",
                ClientSecrets = { new Secret("secret".Sha256()) },

                AllowedGrantTypes = GrantTypes.HybridAndClientCredentials,

                // where to redirect to after login
                RedirectUris = { "http://location:5002/signin-oidc" },

                // where to redirect to after logout
                PostLogoutRedirectUris = { "http://location:5002/signout-callback-oidc" },

                AllowedScopes = new List<string>
                {
                    IdentityServerConstants.StandardScopes.OpenId,
                    IdentityServerConstants.StandardScopes.Profile,
                    IdentityServerConstants.StandardScopes.OfflineAccess,
                    "Api"
                },
                AllowOfflineAccess = true


            }
         };

Api Configuration

services.AddAuthentication("Bearer")
 .AddJwtBearer("Bearer", options =>
 {
     options.Authority = AuthUrl; // IS loc

     options.Audience = "Api"; 
 });

Client Configuration

services.AddSingleton<IDiscoveryCache>(sp =>
            {
                var factory = sp.GetRequiredService<IHttpClientFactory>();
                return new DiscoveryCache(
                    AuthUrl,
                    () => factory.CreateClient());
            });
            services.AddAuthentication(options =>
            {
                options.DefaultScheme = "Cookies";
                options.DefaultChallengeScheme = "oidc";
            })
            .AddCookie("Cookies")
            .AddOpenIdConnect("oidc", options =>
            {
                options.Authority = AuthUrl;
                options.ClientId = ClientID;
                options.ClientSecret = ClientSecret;
                options.ResponseType = "code id_token";
                options.SaveTokens = true;
                options.GetClaimsFromUserInfoEndpoint = true;

                // part 3
                options.Scope.Add("openid");
                options.Scope.Add("offline_access");
                options.Scope.Add("Api");
                options.RequireHttpsMetadata = false;
            });

Here is how I have used Signing Credentials

// not recommended for production - you need to store your key material somewhere secure
        if (Environment.IsDevelopment())
        {
            builder.AddDeveloperSigningCredential();
        }
        else
        {
            X509Certificate2 cert = null;
            using (var certStore = new X509Store(StoreName.My, StoreLocation.LocalMachine))
            {
                certStore.Open(OpenFlags.ReadOnly);
                var certCollection = certStore.Certificates.Find(
                    X509FindType.FindByThumbprint,
                    "76588d12094bc26991faf9e3eaaa241d973fe72f", // Change this with the thumbprint of your certificate
                    false);

                if (certCollection.Count > 0)
                {
                    cert = certCollection[0];
                }
            }
            builder.AddSigningCredential(cert);
        }

I have used a self signed certificate generated through openssl and I have tested this works in developers environment too by not using the .developerssigningcredentials.

Answer 1

Make sure that your IIS pool of your website has access to your private certificate key.

you can try using LocalSystem