Web API Bearer token authentication Authorize doesn't work

Question

I am developing ASP.NET Web API application with Identity 2.0 Bearer authentication. I have configured bearer authentication and implemented SignIn method, so that when I pass header:

Authorization: Bearer uGjAWZA1nPc1AqPuKpAzPhb989SYbtGd...

It works normally. I can call User.Identity.GetUserId() or User.Identity.GetUserName(). I even can check if user is in some role or not, and it also works good.

What is doesn't work, is [Authorize] attribute. When I specify roles, like that [Authorize(Roles = "Admin")] it returns:

{
    Message: "Authorization has been denied for this request."
}

Any thoughts?

Evgeniya Rudakovskaya · Accepted Answer · 2014-09-24 12:12:05Z

3

Have you added Role claim when creating your identity?

userIdentity.AddClaim(new Claim(ClaimTypes.Role, "Admin"));

answered Sep 24, 2014 at 12:12

Evgeniya Rudakovskaya

3195 silver badges15 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Andrei Over a year ago

Excellent! What if at one day admin will change role for user? In this case user will no longer be an Admin but he will be able to use admin resources. How to handle this?

Collectives™ on Stack Overflow

Web API Bearer token authentication Authorize doesn't work

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related