title: Separating Auth and Resource Servers with AspNet.Security.OpenIdConnect - the Audience?
body: <p>The example on the <a href="https://github.com/aspnet-contrib/AspNet.Security.OpenIdConnect.Server/blob/vNext/samples/Mvc/Mvc.Server/Startup.cs" rel="nofollow">AspNet.Security.OpenIdConnect.Server</a> looks to me like both an auth and resource server. I would like to separate those. I have done so.</p>
  
  <p>At the auth server's Startup.Config, I have the following settings:</p>
  
  <pre><code>app.UseOpenIdConnectServer(options =&gt; {
  
      options.AllowInsecureHttp = true;
      options.ApplicationCanDisplayErrors = true;
      options.AuthenticationScheme = OpenIdConnectDefaults.AuthenticationScheme;
      options.Issuer = new System.Uri("http://localhost:61854"); // This auth server
      options.Provider = new AuthorizationProvider();
      options.TokenEndpointPath = new PathString("/token");              
      options.UseCertificate(new X509Certificate2(env.ApplicationBasePath + "\\mycertificate.pfx","mycertificate"));
  
  });
  </code></pre>
  
  <p>I have an AuthorizationProvider written, but I don't think it's relevant to my current issue (but possibly relevant). At its GrantResourceOwnerCredentials override, I hard-code a claims principal so that it validates for every token request:</p>
  
  <pre><code>public override Task GrantResourceOwnerCredentials(GrantResourceOwnerCredentialsNotification context)
  {
      var identity = new ClaimsIdentity(OpenIdConnectDefaults.AuthenticationScheme);
  
      identity.AddClaim(ClaimTypes.Name, "me");
      identity.AddClaim(ClaimTypes.Email, "me@gmail.com");
      var claimsPrincipal = new ClaimsPrincipal(identity);
  
      context.Validated(claimsPrincipal);
      return Task.FromResult&lt;object&gt;(null);
  }
  </code></pre>
  
  <p>At the resource server, I have the following in its Startup.config:</p>
  
  <pre><code>app.UseWhen(context =&gt; context.Request.Path.StartsWithSegments(new PathString("/api")), branch =&gt;
  {
      branch.UseOAuthBearerAuthentication(options =&gt; {
          options.Audience = "http://localhost:54408"; // This resource server, I believe.
          options.Authority = "http://localhost:61854"; // The auth server
          options.AutomaticAuthentication = true;               
      });
  });
  </code></pre>
  
  <p>On Fiddler, I ask for a token, and I get one:</p>
  
  <pre><code>POST /token HTTP/1.1
  Host: localhost:61854
  Content-Type: application/x-www-form-urlencoded
  
  username=admin&amp;password=aaa000&amp;grant_type=password
  </code></pre>
  
  <p>So now I use that access token to access a protected resource from the resource server:</p>
  
  <pre><code>GET /api/values HTTP/1.1
  Host: localhost:54408
  Content-Type: application/json;charset=utf-8
  Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI.....
  </code></pre>
  
  <p>I now get this error - Audience validation failed. Audiences: 'empty'. Did not match validationParameters.ValidAudience: '<a href="http://localhost:54408" rel="nofollow">http://localhost:54408</a>' or validationParameters.ValidAudiences: 'null'.</p>
  
  <p>I think the reason why is because I never set an audience at the auth server (at app.UseOpenIdConnectServer(...)), so I don't think it wrote audience info to the token. So I need to set an audience at the auth server (as what is done in IdentityServer3), but I can't find a property on the options object that would let me do that.</p>
  
  <p>Does AspNet.Security.OpenIdConnect.Server require the auth and resource to be in the same server?</p>
  
  <p>Is setting the audience done when putting together the ClaimsPrincipal, and if so, how?</p>
  
  <p>Would I need to write a custom Audience validator and hook it up to the system? (I sure hope the answer to this is no.)</p>