ASP.NET API returns Authorization has been denied for this request on localhost but works normally on Azure

Question

[Authorize]
    public class ValuesController : ApiController
    {
        // GET api/values
        public IEnumerable<string> Get()
        {
            return new string[] { "Simple" , "Test"};
        }
}

This is a simple "Web API 2" app.

public void ConfigureAuth(IAppBuilder app)
        {
            app.UseWindowsAzureActiveDirectoryBearerAuthentication(
              new WindowsAzureActiveDirectoryBearerAuthenticationOptions
              {
                  Tenant = ConfigurationManager.AppSettings["ida:Tenant"],
                  TokenValidationParameters = new TokenValidationParameters
                  {
                      SaveSigninToken = true,
                      ValidAudience = ConfigurationManager.AppSettings["ida:Audience"]
                  },
              });
        }

As shown the application is using the WindowsAzureActive Directory authentication and Authorization.

Note that it works normally when published to Azure Api App, but always denies the request when in localhost.

I am not sure what happened, it used to work before.

Regards

vibronet · Accepted Answer · 2016-04-11 17:03:25Z

1

Normally this is due to a mismatch in the audience you expect in the web API (the value you set via ValidAudience) and what you get in the incoming token. The value in the token reflects the resource identifier you used when requesting the token from the client. Do you change the client code to request a different audience when calling the localhost instance vs the Azure API one? Also, how do you publish the API to Azure? If you use VS, and in the Publish wizard settings you have the checkbox "use organizational auth" checked, the deployed web API will have a different audience value in its web.config.

answered Apr 11, 2016 at 17:03

vibronet

7,3942 gold badges21 silver badges21 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Amr Elsehemy Over a year ago

Yes, I found out this is the case. But I am not sure I fully understand this, because on Azure it works as is. But localhost it doesn't. It only works if I change the Audience to the same as the App Uri from the azure portal. Now I am stuck that login from SPA fails since it needs the audience same as the ClientId and not the App Uri. any ideas here?

vibronet Over a year ago

Instead of validAudience, please use torknvalidationparameters.validaudiences (plural) and add there both the clientID and the app id uri

Amr Elsehemy Over a year ago

I didn't notice that this is actually you; thanks and great work in AAD; amazing Build session

Collectives™ on Stack Overflow

ASP.NET API returns Authorization has been denied for this request on localhost but works normally on Azure

1 Answer 1

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related