title: Authorize Filter in Web Api 2.0 With OauthBearerTokens Not Working
body: <p>I have a Single Page Application (Angular Js + AspNet Web API) using OAuthBearerToken style authentication</p>
  
  <p>My Code Is as follows</p>
  
  <pre><code>[assembly: OwinStartupAttribute(typeof(App.Web.Startup))]
  namespace App.Web
  {
      public partial class Startup
      {
       public void Configuration(IAppBuilder app)
        {
          var config = new HttpConfiguration();
          config.SuppressDefaultHostAuthentication();
  
  
          config.Formatters.Remove(config.Formatters.XmlFormatter);
          var jsonFormatter = config.Formatters.OfType&lt;JsonMediaTypeFormatter&gt;().First();
          jsonFormatter.SerializerSettings.ContractResolver = new CamelCasePropertyNamesContractResolver();
  
  
          config.Filters.Add(new ValidateModelStateAttribute());
          config.Filters.Add(new HostAuthenticationFilter(OAuthDefaults.AuthenticationType));
  
          // Web API routes
          config.MapHttpAttributeRoutes();
  
          config.Routes.MapHttpRoute(
              name: "DefaultApi",
              routeTemplate: "api/{controller}/{id}",
              defaults: new { id = RouteParameter.Optional }
          );
  
          //register autofac
          var builder = new ContainerBuilder();
  
          builder.RegisterModelBinders(Assembly.GetExecutingAssembly());
          builder.RegisterControllers(Assembly.GetExecutingAssembly());
          builder.RegisterFilterProvider();
          builder.RegisterModelBinderProvider();
  
          builder.RegisterWebApiFilterProvider(config);
          builder.RegisterWebApiModelBinders(Assembly.GetExecutingAssembly());
          builder.RegisterApiControllers(Assembly.GetExecutingAssembly());
  
  
          var container = builder.Build();
          var resolver = new AutofacWebApiDependencyResolver(container);
          config.DependencyResolver = resolver;
          app.UseAutofacMiddleware(container);
          app.UseAutofacWebApi(config);
          app.UseWebApi(config);
          ConfigureOAuth(app, container);
      }
  
       public void ConfigureOAuth(IAppBuilder app, IContainer container)
        {
          var oAuthServerOptions = new OAuthAuthorizationServerOptions()
          {
              AllowInsecureHttp = true,
              TokenEndpointPath = new PathString("/token"),
              AccessTokenExpireTimeSpan = TimeSpan.FromDays(1),
  
              Provider = container.Resolve(typeof(SimpleAuthorizationServerProvider)) as IOAuthAuthorizationServerProvider
          };
          app.UseOAuthBearerTokens(oAuthServerOptions);
          app.UseOAuthAuthorizationServer(oAuthServerOptions);
          app.UseOAuthBearerAuthentication(new OAuthBearerAuthenticationOptions());
  
      }
  }
  </code></pre>
  
  <p>}</p>
  
  <p>My SimpleAuthorizationProvider Implementation is as listed below</p>
  
  <pre><code> public class SimpleAuthorizationServerProvider : OAuthAuthorizationServerProvider
    {
  
      public override async Task ValidateClientAuthentication(OAuthValidateClientAuthenticationContext context)
  
      {
          context.Validated();
  
      }
      public override async Task GrantResourceOwnerCredentials(OAuthGrantResourceOwnerCredentialsContext context)
      {
  
          context.OwinContext.Response.Headers.Add("Access-Control-Allow-Origin", new[] {"*"});
  
          var userManager = context.OwinContext.GetAutofacLifetimeScope().Resolve&lt;IUserStore&lt;User&gt;&gt;() as UserStore;
          if (userManager != null)
          {
              var user = await userManager.FindByNameAsync(context.UserName);
  
              if (user == null)
              {
                  context.SetError("invalid_grant", "The user name or password is incorrect.");
                  return;
              }
              var phash = await userManager.GetPasswordHashAsync(user);
              //the hash of the incoming password
              var passwordHasher = new PasswordHasher();
              var result = passwordHasher.VerifyHashedPassword(phash, context.Password);
  
              if (result == PasswordVerificationResult.Success)
              {
                  var identity = new ClaimsIdentity(context.Options.AuthenticationType);
                  identity.AddClaim(new Claim(ClaimTypes.Sid, user.Id.ToString()));
                  identity.AddClaim(new Claim(ClaimTypes.Email, user.UserName));
                  context.Validated(identity);
                                 }
              else
              {
                  context.SetError("invalid_grant", "The user name or password is incorrect.");
  
              }
  
          }
      }
  
  
  }
  </code></pre>
  
  <p>Now here goes the problem
  When I Issue a post request to the /token endpoint. Everything works well and I get a bearer token returned</p>
  
  <p>Whenever i try to access an action method annotated with the authorize attribute with HTTP Authorization Header set to Bearer {access_token} I get the message</p>
  
  <p>"Authorization has been denied for this request".</p>
  
  <p>Please Am I doing something wrong?</p>