title: Always get "Authorization has been denied for this request." using Bearer tokens in Identity 2?
body: <p>Using postman I can request a token, here it is:</p>
  
  <pre><code>{
      "access_token": "N1FL606bmDkZyLplpkLAihaviMQhB042z-rhY262M_W5nSWIv8fDOQiYkEn6GCuDnrxpdOWBS7lpxlBazHYlwnP1RvpDFED1i_ml89QNspyGOWB6TcMkT1MmfUAZ617k9MNvl5UJh2jKzUwvDDeXMURG9tEtmE3UX2L2D-1VA9kqYOzOB1UYbpMAfdTi84jsbR0lhLkNkReQ5fqg4B3IFbbWNGWu5ONb1uuf00ixL-BIMqSvEaNn58_zCyAVFWVzcH2tayYTGT5p_AItKfYiWaYHKC0pDoZ_OBdlpB7Odc7ScwjwFM5vtpBZE81rpk8yjXnrTEk_j9n0eiloJnpWwA",
      "token_type": "bearer",
      "expires_in": 899,
      "refresh_token": "60da311d10f043b892c703c7fb7ab061",
      "as:client_id": "Erp",
      "userName": "bbauer",
      ".issued": "Tue, 30 Jun 2015 17:56:10 GMT",
      ".expires": "Tue, 30 Jun 2015 18:11:10 GMT"
  }
  </code></pre>
  
  <p>I can also get information from an unprotected resource like so:
  <a href="http://localhost:60689/api/Accounts/User/bbauer" rel="nofollow">http://localhost:60689/api/Accounts/User/bbauer</a></p>
  
  <pre><code>{
      "url": "http://localhost:60689/api/accounts/user/31",
      "id": 31,
      "userName": "bbauer",
      "fullName": "Brian Bauer",
      "email": null,
      "emailConfirmed": false,
      "roles": [
          "Administrator"
      ],
      "claims": []
  }
  </code></pre>
  
  <p>From that I see that the user is in the "Administrator" role. When I try to get a protected resource, I ALWAYS get this back: <strong><em>"Authorization has been denied for this request."</em></strong></p>
  
  <p>Here is the method in the controller:</p>
  
  <pre><code>[Authorize(Roles = "Administrator")]
  [Route("user/{id:int}", Name = "GetUserById")]
  public async Task&lt;IHttpActionResult&gt; GetUser(int id)
  {
      var user = await AppUserManager.FindByIdAsync(id);
  
      if (user != null)
      {
          return Ok(TheModelFactory.Create(user));
      }
  
      return NotFound();
  }
  </code></pre>
  
  <p>Here are my settings in postman:
  <a href="http://localhost:60689/api/Accounts/User/31" rel="nofollow">http://localhost:60689/api/Accounts/User/31</a><br>
  <strong>Content-Type:</strong> application/json<br>
  <strong>Accept:</strong> application/json<br>
  <strong>Authorization:</strong> Bearer N1FL606bmDkZyLplpkLAihaviMQhB042z-rhY262M_W5nSWIv8fDOQiYkEn6GCuDnrxpdOWBS7lpxlBazHYlwnP1RvpDFED1i_ml89QNspyGOWB6TcMkT1MmfUAZ617k9MNvl5UJh2jKzUwvDDeXMURG9tEtmE3UX2L2D-1VA9kqYOzOB1UYbpMAfdTi84jsbR0lhLkNkReQ5fqg4B3IFbbWNGWu5ONb1uuf00ixL-BIMqSvEaNn58_zCyAVFWVzcH2tayYTGT5p_AItKfYiWaYHKC0pDoZ_OBdlpB7Odc7ScwjwFM5vtpBZE81rpk8yjXnrTEk_j9n0eiloJnpWwA</p>
  
  <p>I can use fiddler to verify the authorization header is being sent. Another thing to note is when I pass the access_token in to get the unprotected /user/username resource, I can break in code and see the ClaimsPrincipal with these settings:<br>
  <strong>AuthenticationType:</strong> Bearer<br>
  <strong>IsAuthenticated:</strong> true<br>
  <strong>Name:</strong> bbauer</p>
  
  <p>However, if I test User.IsInRole("Administrator") its always false. Why is it false? The AspNetUserRole table has the entry, and when I fetch the user I see his one role of "Administrator"... what on God's green earth am I missing here?</p>
  
  <p>Here is my Startup class if that helps:</p>
  
  <pre><code>public class Startup
  {
      public static OAuthAuthorizationServerOptions OAuthServerOptions { get; private set; }
      public static OAuthBearerAuthenticationOptions OAuthBearerOptions { get; private set; }
      public static string PublicClientId { get; private set; }
  
      public void Configuration(IAppBuilder app)
      {
          var httpConfig = new HttpConfiguration();
  
          ConfigureOAuth(app);
  
          WebApiConfig.Register(httpConfig);
  
          app.UseCors(CorsOptions.AllowAll);
          app.UseWebApi(httpConfig);
      }
  
      public void ConfigureOAuth(IAppBuilder app)
      {
          // Configure the db context and user manager to use a single instance per request
          app.CreatePerOwinContext(ApplicationDbContext.Create);
          app.CreatePerOwinContext&lt;ApplicationUserManager&gt;(ApplicationUserManager.Create);
          app.CreatePerOwinContext&lt;ApplicationRoleManager&gt;(ApplicationRoleManager.Create);
  
          PublicClientId = "self";
          OAuthServerOptions = new OAuthAuthorizationServerOptions
          {
              AllowInsecureHttp = true,
              TokenEndpointPath = new PathString("/Token"),
              AccessTokenExpireTimeSpan = TimeSpan.FromMinutes(15),
              Provider = new SimpleAuthorizationServerProvider(PublicClientId),
              RefreshTokenProvider = new SimpleRefreshTokenProvider(),
          };
  
          app.UseOAuthAuthorizationServer(OAuthServerOptions);
  
          OAuthBearerOptions = new OAuthBearerAuthenticationOptions();
          app.UseOAuthBearerAuthentication(OAuthBearerOptions);
      }
  }
  </code></pre>