which TokenValidationParameters are needed with UseJwtBearerAuthentication

Question

I am tying to do JwtBearerAuthentication on my .net WebAPI and it is just not working. The Authorize attribute is always claiming isAuthorized = false.

I am working with Okta as the SSO. I am authenticating on my client side and getting both an access token and id token. On a webapi get request I am providing the access token (i have also tried the id token) in the authorize header and I am able to see the authorize header with the token in the webapi actioncontext.

In my startup.cs I have the following

var clientID = WebConfigurationManager.AppSettings["okta:ClientId"];

var oidcIssuer = WebConfigurationManager.AppSettings["okta:OIDC_Issuer"];

TokenValidationParameters tvps = new TokenValidationParameters
{
    ValidAudience = clientID,
    ValidateAudience = true,
    ValidIssuer = oidcIssuer,
    ValidateIssuer = true  
};

app.UseJwtBearerAuthentication(new JwtBearerAuthenticationOptions
{
    TokenValidationParameters = tvps,
    IssuerSecurityTokenProviders = new IIssuerSecurityTokenProvider[]
    {
        new OpenIdConnectCachingSecurityTokenProvider(oidcIssuer + "/.well-known/openid-configuration")
    }
});

Am i missing some TokenValidationParameters that I need?

Answer 1

My problem was not with the options. It was 100% the need to move

app.UseWebApi(config);

below all the owin setup stuff.