OData / OData/AspNetCoreOData

OData 8.x with ASP.NET 5 always returns 401 Unauthorized on api endpoints

Open
#289 7 comments 0 reactions 1 assignee View on GitHub

@xuzhg is already working on this.

Since Aug 31, 2021.

followup
Dominant language
C#
Stars
505
Forks
186
PR merge metrics
No merged PRs in 30d

Description

New ASP.NET 5 api project that is trying to use Bearer token authentication against OData 8 endpoints. All requests result in 401 Unathoized being returned as if the token is not even being checked.

The same code works fine with ASP.NET 5 and OData 7.x.

public void ConfigureServices(IServiceCollection services) {
	...
	if (Environment.IsLocal()) {
		services
			.AddAuthentication("BasicAuthentication")
			// MockAuthenticatedUser inherits from AuthenticationHandler for local development/testing purposes
			.AddScheme<AuthenticationSchemeOptions, MockAuthenticatedUser>("BasicAuthentication", null);
	}
	else {
		services.AddDistributedMemoryCache();

		services
			.AddAuthentication(IdentityServerAuthenticationDefaults.AuthenticationScheme)
			.AddIdentityServerAuthentication(options => {
				options.Authority = ssoSettings.BaseUri.ToString();
				options.ApiName = "xyz";
				options.ApiSecret = ssoSettings.ClientSecret;

				options.EnableCaching = true;
			});
	}
	...
	services.AddSwaggerGen(c => {
		...
	});
	...
	services
		.AddControllers(options => {
			var policy = new AuthorizationPolicyBuilder().RequireAuthenticatedUser().Build();
			options.Filters.Add(new AuthorizeFilter(policy));
		})
		.AddOData(opt => {
			opt
				.Count()
				...
				.AddRouteComponents("api", EdmModelBuilder.GetEdmModel());
		});
}

public void Configure(IApplicationBuilder app) {
	...
	app.UseAuthorization();
	app.UseAuthentication();

	app.UseEndpoints(endpoints => {
		endpoints
			.MapControllers()
			.RequireAuthorization();
	});
}

The issue does not seem to be specific to AddIdentityServerAuthentication(). During local development, using my MockAuthenticatedUser handler, the same 401 Unauthorized is returned. Breakpoints in the handler will trigger when Swagger page is viewed -- indicating that authentication is configured correctly -- but does not trigger when api requests are made.

Unable to find documentation or samples in this repo on proper configuration.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.