{"action":"created","issue":{"url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/2543","repository_url":"https://api.github.com/repos/IdentityServer/IdentityServer3","labels_url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/2543/labels{/name}","comments_url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/2543/comments","events_url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/2543/events","html_url":"https://github.com/IdentityServer/IdentityServer3/issues/2543","id":131994050,"number":2543,"title":"Access OpenIdConnectAuthentication ApiController using HttpClient","user":{"login":"totpero","id":1710257,"avatar_url":"https://avatars.githubusercontent.com/u/1710257?v=3","gravatar_id":"","url":"https://api.github.com/users/totpero","html_url":"https://github.com/totpero","followers_url":"https://api.github.com/users/totpero/followers","following_url":"https://api.github.com/users/totpero/following{/other_user}","gists_url":"https://api.github.com/users/totpero/gists{/gist_id}","starred_url":"https://api.github.com/users/totpero/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/totpero/subscriptions","organizations_url":"https://api.github.com/users/totpero/orgs","repos_url":"https://api.github.com/users/totpero/repos","events_url":"https://api.github.com/users/totpero/events{/privacy}","received_events_url":"https://api.github.com/users/totpero/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2016-02-07T18:10:46Z","updated_at":"2016-02-12T05:29:47Z","closed_at":null,"body":"Hello,\r\nI have one IdSrv3 and many clients connected using OpenIdConnect.\r\nOne of my OpenId client is implemented in Idsrv3 application because is the Admin application.\r\nIn this client i can create users, add users to groups, etc (admin operations).\r\nIn this admin client i have  [Authorize] actions in ApiController to allow other clients to create (external restricted API).\r\nIn my idSrv3 server i have implement custom UserService because i filter role claims by CleintId.\r\n\r\nNow i want to access this admin [Authorize] client action from other OpenId MVC app client using HttpClient but how?\r\n\r\nI set my clients to:\r\n```\r\nFlow = Flows.Implicit,\r\nAllowClientCredentialsOnly = true, \r\n```\r\n\r\nIf i call idsrv to get adminClient AccessToken using:\r\n```\r\nvar tokenClient = new TokenClient(\"idsrvtokenaddres\",\"clientAdmin\",\"secret\");\r\nvar tokenResponse = await tokenClient.RequestClientCredentialsAsync(\"user_registration\");\r\n```\r\n\r\nThis return access token but if i try to access ApiController action using this access toke like this:\r\n```\r\nvar client = new HttpClient { BaseAddress = new Uri(\"idsrvaddres\") };\r\nclient.SetBearerToken(tokenResponse.AccessToken);\r\n var result = await client.GetStringAsync(\"api/action\");\r\n```\r\nI get the response the idsrv3 login page.\r\n\r\ni have try also to access this Api using current client user access token:\r\n\r\n```\r\nvar claimsPrincipal = User as ClaimsPrincipal;\r\nvar token = claimsPrincipal.FindFirst(\"access_token\").Value;\r\n```\r\nbut the same problem, i get the login page.\r\n\r\nI try to simulate this case using  [MVC Authentication sample](https://github.com/IdentityServer/IdentityServer3.Samples/tree/master/source/MVC%20Authen) by replacing `UseIdentityServerBearerTokenAuthentication` from Api Application with `UseOpenIdConnectAuthentication` and i get also the login page in the response.\r\n\r\nHow can i access this admin client Api controller using current logged user from another openid client or how can i solve this scenario?\r\n"},"comment":{"url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/comments/183185280","html_url":"https://github.com/IdentityServer/IdentityServer3/issues/2543#issuecomment-183185280","issue_url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/2543","id":183185280,"user":{"login":"mderriey","id":6102639,"avatar_url":"https://avatars.githubusercontent.com/u/6102639?v=3","gravatar_id":"","url":"https://api.github.com/users/mderriey","html_url":"https://github.com/mderriey","followers_url":"https://api.github.com/users/mderriey/followers","following_url":"https://api.github.com/users/mderriey/following{/other_user}","gists_url":"https://api.github.com/users/mderriey/gists{/gist_id}","starred_url":"https://api.github.com/users/mderriey/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mderriey/subscriptions","organizations_url":"https://api.github.com/users/mderriey/orgs","repos_url":"https://api.github.com/users/mderriey/repos","events_url":"https://api.github.com/users/mderriey/events{/privacy}","received_events_url":"https://api.github.com/users/mderriey/received_events","type":"User","site_admin":false},"created_at":"2016-02-12T05:29:47Z","updated_at":"2016-02-12T05:29:47Z","body":"OK, I think I get what's wrong.\r\n\r\nIf you have a look at [this file](https://github.com/IdentityServer/IdentityServer3.Samples/blob/master/source/MVC%20Authentication/EmbeddedMvc/Startup.cs), 2 main registrations are made.\r\nThe first one is for IdentityServer, which is mapped to the path `/identity`, which means that any requests matching this path will be processed by IdentityServer.\r\nThe second one, for the MVC application, is not mapped to a specific path, so all the requests not matching `/identity` will flow through the rest of the registrations ([L55](https://github.com/IdentityServer/IdentityServer3.Samples/blob/master/source/MVC%20Authentication/EmbeddedMvc/Startup.cs#L55) to [L124](https://github.com/IdentityServer/IdentityServer3.Samples/blob/master/source/MVC%20Authentication/EmbeddedMvc/Startup.cs#L124)).\r\n\r\nWhat I think happens is that your WebAPI calls, which I guess hit `/api/action`, go through the main OWIN pipeline, in which you inserted the OpenID Connect middleware. This explains why you get IdentityServer login page.\r\n\r\nWhat you should do is have a specific OWIN pipeline for you WebAPI calls, let's say by matching `/api`, in which you insert the token validation middleware.\r\n\r\nLet me know if this is clear enough."}}