setup IdentityServer3 in azure

Question

I have setup IdentityServer3 locally and everything works fine. I am using JWT to authorize my users and have been able to successfully access my Web API controllers (with the authorize attribute).

When I uploaded to azure, although I can get an access token but when I try to access a controller, I get a 401 error. I assume this is to do with the certificate. My configuration looks like this:

public static class Config
{

    /// <summary>
    /// Configures identity server
    /// </summary>
    public static void ConfigureIdentityServer(this IAppBuilder app, CormarConfig config)
    {

        // Create our options
        var identityServerOptions = new IdentityServerOptions
        {
            SiteName = "Cormar API",
            SigningCertificate = LoadCertificate(),
            IssuerUri = "https://localhost:44313",

            // Not needed
            LoggingOptions = new LoggingOptions
            {
                EnableHttpLogging = true,
                EnableWebApiDiagnostics = true,
                EnableKatanaLogging = true,
                WebApiDiagnosticsIsVerbose = true
            },

            // In membory crap just to get going
            Factory = new IdentityServerServiceFactory().Configure(config),         

            // Disable when live
            EnableWelcomePage = true
        };

        // Setup our auth path
        app.Map("/identity", idsrvApp =>
        {
            idsrvApp.UseIdentityServer(identityServerOptions);
        });
    }


    /// <summary>
    /// Configures the identity server to use token authentication
    /// </summary>
    public static void ConfigureIdentityServerTokenAuthentication(this IAppBuilder app, HttpConfiguration config)
    {
        app.UseIdentityServerBearerTokenAuthentication(new IdentityServerBearerTokenAuthenticationOptions
        {
            Authority = "https://localhost:44313/identity",
            ValidationMode = ValidationMode.ValidationEndpoint,
            RequiredScopes = new[] { "api" }
        });

        AntiForgeryConfig.UniqueClaimTypeIdentifier = IdentityServer3.Core.Constants.ClaimTypes.Subject;
        JwtSecurityTokenHandler.InboundClaimTypeMap = new Dictionary<string, string>();
    }

    /// <summary>
    /// Loads the certificate
    /// </summary>
    /// <returns></returns>
    private static X509Certificate2 LoadCertificate()
    {
        var certPath = $"{ AppDomain.CurrentDomain.BaseDirectory }App_Data\\idsrv3test.pfx";
        return new X509Certificate2(certPath, "idsrv3test");
    }

    /// <summary>
    /// Configure the identity service factory with custom services
    /// </summary>
    /// <returns></returns>
    private static IdentityServerServiceFactory Configure(this IdentityServerServiceFactory factory, CormarConfig config)
    {
        var serviceOptions = new EntityFrameworkServiceOptions { ConnectionString = config.SqlConnectionString };
        factory.RegisterOperationalServices(serviceOptions);
        factory.RegisterConfigurationServices(serviceOptions);

        factory.CorsPolicyService = new Registration<ICorsPolicyService>(new DefaultCorsPolicyService { AllowAll = true }); // Allow all domains to access authentication
        factory.Register(new Registration<DbContext>(dr => dr.ResolveFromAutofacOwinLifetimeScope<DbContext>()));
        factory.UserService = new Registration<IUserService>(dr => dr.ResolveFromAutofacOwinLifetimeScope<IUserService>());
        factory.ClientStore = new Registration<IClientStore>(dr => dr.ResolveFromAutofacOwinLifetimeScope<IClientStore>());
        factory.ScopeStore = new Registration<IScopeStore>(dr => dr.ResolveFromAutofacOwinLifetimeScope<IScopeStore>());

        return factory;
    }
}

I have been reading and it looks like if I use reference tokens, I don't need to use a certificate to sign them. So I changed my client AccessTokenType to reference token and added the secret to the api scope and I was able to access my protected controllers locally, but again when I push to azure, I still get a 401.

Does anyone know how I can solve this issue?

Answer 1

Changing the settings for UseIdentityServerBearerTokenAuthentication was the solution to this. I updated the options to this:

DelayLoadMetadata = true,

And it all started working.