Unauthorized access to API despite getting Access Token and Scope

Sorry for not clarifying before. The frontend is Blazor WASM and Backend is .NET 8.

Are you using Azure AD or Azure AD b2c?

Azure AD B2C

Thank you for your confirmation, since it's blazor wasm application without asp.net core hosted, so that we should refer to this document to integrate Azure AD b2c into the blazor wasm application, then use IAccessTokenProvider to generate the access token, since you already obtained access token successfully, I think you've set everything done in the client blazor application. Then we shall follow this document to set up the api project. But I also checked your appsettings.json and Program.cs which all looks good. I'm confused that we've been able to get the access token so that the authentication should work in blazor wasm application, then does the CustomIdentityMiddleware belong to your API project? I'm afraid yes, then it shall be the expected behavior since it's an API project, it just do the authorization validation, but not handle the authentication, we can't get the authenticated user in the API project, we can only check whether the access token inside the request header is valid or not, by the way, we don't need a custom middleware to do the token validation task. May I know how you send the http request to call the web api? Did you add the access token into Authorization request header?

In the meantime, if you are getting trouble to sign into the application, you might create a new project and compare it with yours. You can use this command to create a new project. dotnet new blazorwasm -au IndividualB2C --aad-b2c-instance "{AAD B2C INSTANCE}" --client-id "{CLIENT ID}" --domain "{TENANT DOMAIN}" -o {PROJECT NAME} -ssp "{SIGN UP OR SIGN IN POLICY}" But I trust your blazor app is working well not. Then pls don't forget to add CORS policy into the Api project. The request is sent from the SPA, so that CORS policy is required. I checked your appsettings.json and Program.cs, I think you've done the configuration so that the issue might related to how you call the API in your blazor app. Have you tried to use tools like postman to call your web api endpoint with your access token? If that worked, we could say the Api is well configured too.

Hey Tiny,

I have another project that a friend is working on. I compared my code to his and we have the same code yet his API calls work. I feel like i am missing something inside the Azure portal. Can you make sense of its manifest if i send it here?

User controller:

[Authorize]
[ApiController]
[Route("api/[controller]")]
public class UserController : ControllerBase
{
    private readonly UserService _userService;
    private readonly HttpService _httpService;
    [HttpGet]
    public IActionResult Get()
    {
        return Ok("Authorized");
    }

API call in client:

using Microsoft.AspNetCore.Components;
using SchoolConnect.Shared.Dtos;
using System.Net.Http.Json;
namespace SchoolConnect.Client.Shared;
public partial class Dashboard : ComponentBase
{
    [Inject] private HttpClient Http { get; set; }
    protected override async Task OnInitializedAsync()
    {
        var currentUser = await Http.GetFromJsonAsync<List<UserDTO>>($"api/User");
        StateHasChanged();
    }
}

Have you tried to use tools like postman to call your web api endpoint with your access token?

I need to try this, i am working on this now

Hi, I don't have a b2c application so that I can't share my configuration in Azure, but since you were already able to sign in and get the access token, I think the configuration in Azure should be correct. In your blazor component, I could see that you sent http request to the API, but I didn't see you adding request header in HttpClient. Then our codes shall be similar to codes below. Could you please test it?

HttpClient client = new HttpClient();
client.DefaultRequestHeaders.Authorization = new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", "accessToken");

My friend is also not adding headers to Http, that is happening automatically when you do this in program.cs:

builder.Services.AddHttpClient("SchoolConnect.ServerAPI", client => client.BaseAddress = new Uri(builder.HostEnvironment.BaseAddress))

.AddHttpMessageHandler<BaseAddressAuthorizationMessageHandler>();

builder.Services.AddScoped(sp => sp.GetRequiredService<IHttpClientFactory>().CreateClient("SchoolConnect.ServerAPI"));

Okay, if you are sure that you've added the bearer token in the request header somewhere else, then could you please help confirm whether you could call the API successfully with postman and the token you generated. And have you added the CORS policy into your API project? CORS policy won't affect the test through postman, but will affect the test through your blazor app.

using Microsoft.AspNetCore.Components;
using SchoolConnect.Shared.Dtos;
using System.Net.Http.Json;
namespace SchoolConnect.Client.Shared;
public partial class Dashboard : ComponentBase
{
    /*[Inject] private HttpClient Http { get; set; }*/
    protected override async Task OnInitializedAsync()
    {
        HttpClient client = new HttpClient();
        client.DefaultRequestHeaders.Authorization = new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", "accessToken");
        var currentUser = await client.GetFromJsonAsync<List<UserDTO>>($"api/User");
        StateHasChanged();
    }
}

I tried, it is not even hitting the breakpoint at HttpClient client.

On Postman if i use the access token and make GET request to: https://localhost:5161/api/User

While my application is turned on

I get this error:

Bearer error="invalid_token", error_description="The issuer 'https://schoolconnectb2c.b2clogin.com/9a9f7282-c81e-4f4d-ad58-1f29ff26afa7/v2.0/' is invalid"