Vfrdtyky

I am implementing JWT Authorization on Asp.Net but I am having a trouble here. When I am trying to access the Dashboard/Home controller's method I am always recieving '401 Unauthorized' response. According to my research I can say that the request can not go through

[Authorize(Policy = "ApiUser")]

But when comment that statement I recieve an error here

var userId = _caller.Claims.Single(c => c.Type == "id");

Which states that sequence conatains no appropriate elements, and if I will print the

_httpContextAccessor.HttpContext.User.Claims

I basically recieve a ''.
Also I want you to notice that the token is
correct

I am testing the application with help of postman

I stacked on this error for two days and really rely on your help. Tell me if some additional code is needed.

Code:

Dashboard Controller:

 [Authorize(Policy = "ApiUser")]

        [Route("api/[controller]/[action]")]

        public class DashboardController : Controller

        {

            private readonly ClaimsPrincipal _caller;

            private readonly BackendContext _appDbContext;

            private readonly IHttpContextAccessor _httpContextAccessor;



            public DashboardController(UserManager<AppUser> userManager, BackendContext appDbContext, IHttpContextAccessor httpContextAccessor)

            {

                _caller = httpContextAccessor.HttpContext.User;

                _appDbContext = appDbContext;

                _httpContextAccessor = httpContextAccessor;

            }



            // GET api/dashboard/home



            [HttpGet]

            public async Task<IActionResult> Home()

            {

                // retrieve the user info

                //HttpContext.User

                //return new OkObjectResult(_httpContextAccessor.HttpContext.User.Claims);

                    var userId = _caller.Claims.Single(c => c.Type == "id");



                var customer = await _appDbContext.Customers.Include(c => c.Identity).SingleAsync(c => c.Identity.Id == userId.Value);



                return new OkObjectResult(new

                {

                    Message = "This is secure API and user data!",

                    customer.Identity.FirstName,

                    customer.Identity.LastName,

                    customer.Identity.PictureUrl,

                    customer.Identity.FacebookId,

                    customer.Location,

                    customer.Locale,

                    customer.Gender

                });

            }

        }

Startup:

public class Startup

    {

        private const string SecretKey = "iNivDmHLpUA223sqsfhqGbMRdRj1PVkH"; // todo: get this from somewhere secure

        private readonly SymmetricSecurityKey _signingKey = new SymmetricSecurityKey(Encoding.ASCII.GetBytes(SecretKey));



        public Startup(IConfiguration configuration)

        {

            Configuration = configuration;

        }



        public IConfiguration Configuration { get; }



        public void ConfigureServices(IServiceCollection services)

        {

            services.AddIdentity<IdentityUser, IdentityRole>()

                .AddEntityFrameworkStores<BackendContext>()

                .AddDefaultTokenProviders();



            services.AddDbContext<BackendContext>(options =>

              options.UseSqlServer(Configuration.GetConnectionString("DefaultConnection"),

                  b => b.MigrationsAssembly("Backend")));



            services.AddSingleton<IJwtFactory, JwtFactory>();

            var jwtAppSettingOptions = Configuration.GetSection(nameof(JwtIssuerOptions));



            // Configure JwtIssuerOptions

            services.Configure<JwtIssuerOptions>(options =>

            {

                options.Issuer = jwtAppSettingOptions[nameof(JwtIssuerOptions.Issuer)];

                options.Audience = jwtAppSettingOptions[nameof(JwtIssuerOptions.Audience)];

                options.SigningCredentials = new SigningCredentials(_signingKey, SecurityAlgorithms.HmacSha256);

            });



            var tokenValidationParameters = new TokenValidationParameters

            {

                ValidateIssuer = true,

                ValidIssuer = jwtAppSettingOptions[nameof(JwtIssuerOptions.Issuer)],



                ValidateAudience = true,

                ValidAudience = jwtAppSettingOptions[nameof(JwtIssuerOptions.Audience)],



                ValidateIssuerSigningKey = true,

                IssuerSigningKey = _signingKey,



                RequireExpirationTime = false,

                ValidateLifetime = true,

                ClockSkew = TimeSpan.Zero

            };



            services.AddAuthentication(options =>

            {

                options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;

                options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;



            }).AddJwtBearer(configureOptions =>

            {

                configureOptions.ClaimsIssuer = jwtAppSettingOptions[nameof(JwtIssuerOptions.Issuer)];

                configureOptions.TokenValidationParameters = tokenValidationParameters;

                configureOptions.SaveToken = true;

            });



            // api user claim policy

            services.AddAuthorization(options =>

            {

                options.AddPolicy("ApiUser", policy => policy.RequireClaim(Constants.Strings.JwtClaimIdentifiers.Rol, Constants.Strings.JwtClaims.ApiAccess));

            });



            // add identity

            var builder = services.AddIdentityCore<AppUser>(o =>

            {

                // configure identity options

                o.Password.RequireDigit = false;

                o.Password.RequireLowercase = false;

                o.Password.RequireUppercase = false;

                o.Password.RequireNonAlphanumeric = false;

                o.Password.RequiredLength = 6;

            });

            builder = new IdentityBuilder(builder.UserType, typeof(IdentityRole), builder.Services);

            builder.AddEntityFrameworkStores<BackendContext>().AddDefaultTokenProviders();



            services.AddAutoMapper();



            services.TryAddSingleton<IHttpContextAccessor, HttpContextAccessor>();

            services.TryAddSingleton<IActionContextAccessor, ActionContextAccessor>();

            services.AddDbContext<BackendContext>(options =>

                options.UseSqlServer(Configuration.GetConnectionString("DefaultConnection"),

                b => b.MigrationsAssembly("Backend")));

            services.AddTransient<IStoreService, StoreService>();

            services.AddMvc();//.AddFluentValidation(fv => fv.RegisterValidatorsFromAssemblyContaining<Startup>());

        }

        public void Configure(IApplicationBuilder app, IHostingEnvironment env)

        {

            if (env.IsDevelopment())

            {

                app.UseDeveloperExceptionPage();

            }

            app.UseAuthentication();

            app.UseDefaultFiles();

            app.UseStaticFiles();



            app.UseMvc();

        }

    }

Constants (used in startup):

 public static class Constants

        {

            public static class Strings

            {

                public static class JwtClaimIdentifiers

                {

                    public const string Rol = "rol", Id = "id";

                }



                public static class JwtClaims

                {

                    public const string ApiAccess = "api_access";

                }

            }

        }  

For your issue is caused by the mismatch configuration between token generation and validation for Issuer and Audience.

In Startup.cs, you configure ValidateIssuer = true and ValidateAudience = true, but for your provided token, there is no iss and aud.

Here are two ways for a try:

• 
  

  Disable to validate Issuer and Audience

  
  
  

      var tokenValidationParameters = new TokenValidationParameters
  
      {
  
          ValidateIssuer = false,
  
          ValidIssuer = "Issuer",
  
  
  
          ValidateAudience = false,
  
          ValidAudience = "Audience",
  
  
  
          ValidateIssuerSigningKey = true,
  
          IssuerSigningKey = _signingKey,
  
  
  
          RequireExpirationTime = false,
  
          ValidateLifetime = true,
  
          ClockSkew = TimeSpan.Zero
  
      };
  
  

  
  


• 
  

  Or, provide the Issuer and Audience while generating the token.

  
  
  

      public IActionResult Login()
  
  {
  
      var secretKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes("iNivDmHLpUA223sqsfhqGbMRdRj1PVkH"));
  
      var signinCredentials = new SigningCredentials(secretKey, SecurityAlgorithms.HmacSha256);
  
  
  
      var tokeOptions = new JwtSecurityToken(
  
          issuer: "Issuer",
  
          audience: "Audience",
  
          claims: new List<Claim>() { new Claim("rol", "api_access") },
  
          expires: DateTime.Now.AddMinutes(25),
  
          signingCredentials: signinCredentials
  
      );
  
  
  
      var tokenString = new JwtSecurityTokenHandler().WriteToken(tokeOptions);
  
      return Ok(new { Token = tokenString });
  
  }
  
  

  
  

Here is a working demo CoreJwt.