{"action":"created","issue":{"url":"https://api.github.com/repos/IdentityServer/IdentityServer4/issues/191","repository_url":"https://api.github.com/repos/IdentityServer/IdentityServer4","labels_url":"https://api.github.com/repos/IdentityServer/IdentityServer4/issues/191/labels{/name}","comments_url":"https://api.github.com/repos/IdentityServer/IdentityServer4/issues/191/comments","events_url":"https://api.github.com/repos/IdentityServer/IdentityServer4/issues/191/events","html_url":"https://github.com/IdentityServer/IdentityServer4/issues/191","id":169352064,"number":191,"title":"[AuthorizeAttribute (Roles=\"\")] doesn't work","user":{"login":"hequs","id":5341281,"avatar_url":"https://avatars.githubusercontent.com/u/5341281?v=3","gravatar_id":"","url":"https://api.github.com/users/hequs","html_url":"https://github.com/hequs","followers_url":"https://api.github.com/users/hequs/followers","following_url":"https://api.github.com/users/hequs/following{/other_user}","gists_url":"https://api.github.com/users/hequs/gists{/gist_id}","starred_url":"https://api.github.com/users/hequs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hequs/subscriptions","organizations_url":"https://api.github.com/users/hequs/orgs","repos_url":"https://api.github.com/users/hequs/repos","events_url":"https://api.github.com/users/hequs/events{/privacy}","received_events_url":"https://api.github.com/users/hequs/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2016-08-04T11:25:40Z","updated_at":"2016-08-06T03:56:58Z","closed_at":null,"body":"I use IdentyServer4 (beta3) for handling an authorization process on my SPA. The solution contains 3 separate projects: Spa, Api and IdentityServer (IS). \r\n\r\nThe flow is the following: the user enters SPA, then he is redirected to the IS login page; once authenticated he is redirected back to the SPA.\r\n\r\nApi is configured to use Jwt Tokens, issued by an IdentityServer, the following way:\r\n```cs\r\nJwtSecurityTokenHandler.DefaultInboundClaimTypeMap.Clear();\r\napp.UseJwtBearerAuthentication(new JwtBearerOptions\r\n{\r\n    Authority = <IdentityServer url>,\r\n    Audience = <IdentityServer url> + \"/resources\",\r\n    AutomaticAuthenticate = true,\r\n    AuthenticationScheme = \"Bearer\",\r\n    RequireHttpsMetadata = false,\r\n    AutomaticChallenge = true\r\n});\r\n```\r\n\r\nAuthorizeAttribute itself (without role validation) works properly, but requests to API methods protected with (Roles=\"\") always return 403, besides JWT token contains all the claims, provided by an Asp.Net Identity (I overrided UserClaimsPrincipalFactory and IProfileService), namely, \"sub\", \"name\", \"AspNet.Identity.SecurityStamp\", \"role\".\r\n\r\n\r\n\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/IdentityServer/IdentityServer4/issues/comments/238004213","html_url":"https://github.com/IdentityServer/IdentityServer4/issues/191#issuecomment-238004213","issue_url":"https://api.github.com/repos/IdentityServer/IdentityServer4/issues/191","id":238004213,"user":{"login":"ariesdane","id":4628335,"avatar_url":"https://avatars.githubusercontent.com/u/4628335?v=3","gravatar_id":"","url":"https://api.github.com/users/ariesdane","html_url":"https://github.com/ariesdane","followers_url":"https://api.github.com/users/ariesdane/followers","following_url":"https://api.github.com/users/ariesdane/following{/other_user}","gists_url":"https://api.github.com/users/ariesdane/gists{/gist_id}","starred_url":"https://api.github.com/users/ariesdane/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ariesdane/subscriptions","organizations_url":"https://api.github.com/users/ariesdane/orgs","repos_url":"https://api.github.com/users/ariesdane/repos","events_url":"https://api.github.com/users/ariesdane/events{/privacy}","received_events_url":"https://api.github.com/users/ariesdane/received_events","type":"User","site_admin":false},"created_at":"2016-08-06T03:56:58Z","updated_at":"2016-08-06T03:56:58Z","body":"Try setting the RoleClaimType = \"role\", and if User.Identity.Name is also empty, then set NameClaimType = \"name\". "}}
{"actor":{"display_login":"ariesdane"}}