title: OpenIddict Password Grant returns Status Code 415
body: <p>Good afternoon,</p>
  <p>So I am working on integrating OpenIddict into an existing project.  I have become stuck on the issuing of the token because I am unable to debug the issue.  So I am getting a two entirely different responses from the controller.  I have tried this through swagger and postman both and gotten the same Status: 415 Unsupported Media Type.  Now I was pretty sure I read that the information coming to the token for the password grant had to be &quot;application/x-www-form-urlencoded&quot;  So that is what I am passing to the controller, but still receiving a 415.  On the flip side of that if I look in the debug log for the project I see the following:</p>
  <pre><code>OpenIddict.Server.OpenIddictServerDispatcher: Information: The request address matched a server endpoint: Token.
  OpenIddict.Server.OpenIddictServerDispatcher: Information: The token request was successfully extracted: {
    &quot;grant_type&quot;: &quot;password&quot;,
    &quot;username&quot;: &quot;Administrator@MRM2Inc.com&quot;,
    &quot;password&quot;: &quot;[redacted]&quot;
  }.
  
  OpenIddict.Server.OpenIddictServerDispatcher: Information: The token request was successfully validated.
  </code></pre>
  <p>That too me looks like it was working.  It never went into the token endpoint as I had a breakpoint immediately set.
  Here is my setup:</p>
  <p>Startup.cs</p>
  <pre><code>public void ConfigureServices(IServiceCollection services)
          {
              services.AddControllers();
  
              services.AddDbContext&lt;IdentDbContext&gt;(options =&gt;
              {
                  //options.UseSqlServer(
                  //    Configuration.GetConnectionString(&quot;IdentityDB&quot;));
  
                  options.UseOpenIddict&lt;Guid&gt;();
              });
                  
  
              
              // Add the Identity Services we are going to be using the Application Users and the Application Roles
              services.AddIdentity&lt;ApplicationUsers, ApplicationRoles&gt;(config =&gt;
              {
                  config.SignIn.RequireConfirmedEmail = true;
                  config.SignIn.RequireConfirmedAccount = true;
                  config.User.RequireUniqueEmail = true;
                  config.Lockout.MaxFailedAccessAttempts = 3;
              }).AddEntityFrameworkStores&lt;IdentDbContext&gt;()
              .AddUserStore&lt;ApplicationUserStore&gt;()
              .AddRoleStore&lt;ApplicationRoleStore&gt;()
              .AddRoleManager&lt;ApplicationRoleManager&gt;()
              .AddUserManager&lt;ApplicationUserManager&gt;()
              .AddErrorDescriber&lt;ApplicationIdentityErrorDescriber&gt;()
              .AddDefaultTokenProviders()
              .AddDefaultUI();
  
              services.AddDataLibrary();    
              
              services.AddAuthentication(options =&gt;
              {
                  options.DefaultAuthenticateScheme = OpenIddictValidationAspNetCoreDefaults.AuthenticationScheme;
              });                
  
              //services.AddSingleton&lt;IGenerateTokens, GenerateTokens&gt;();
  
              // Add in the email
              var emailConfig = Configuration.GetSection(&quot;EmailConfiguration&quot;).Get&lt;EmailConfiguration&gt;();
              services.AddSingleton(emailConfig);
              services.AddEmailLibrary();
  
              services.AddOpenIddict()
                  // Register the OpenIddict core components.
                  .AddCore(options =&gt;
                  {
                      // Configure OpenIddict to use the Entity Framework Core stores and models.
                      // Note: call ReplaceDefaultEntities() to replace the default entities.
                      options.UseEntityFrameworkCore()
                      .UseDbContext&lt;IdentDbContext&gt;()
                      .ReplaceDefaultEntities&lt;Guid&gt;();
                  })
                  // Register the OpenIddict server components.
                  .AddServer(options =&gt;
                  {
                      // Enable the token endpoint.  What other endpoints?
                      options.SetTokenEndpointUris(&quot;/Token&quot;);
  
                      // Enable the client credentials flow.  Which flow do I need?
                      options.AllowPasswordFlow();
  
                      options.AcceptAnonymousClients();
  
                      // Register the signing and encryption credentials.
                      options.AddDevelopmentEncryptionCertificate()
                            .AddDevelopmentSigningCertificate();
  
                      // Register the ASP.NET Core host and configure the ASP.NET Core options.
                      options.UseAspNetCore()                               
                             .EnableTokenEndpointPassthrough();
                  })
                  // Register the OpenIddict validation components.
                  .AddValidation(options =&gt;
                  {
                      // Import the configuration from the local OpenIddict server instance.
                      options.UseLocalServer();
  
                      // Register the ASP.NET Core host.
                      options.UseAspNetCore();
                  });
  
              // Register the Swagger generator, defining 1 or more Swagger documents
              services.AddSwaggerGen(swagger =&gt; 
              {
                  swagger.AddSecurityDefinition(&quot;Bearer&quot;, new OpenApiSecurityScheme()
                  {
                      Name = &quot;Authorization&quot;,
                      Type = SecuritySchemeType.Http,
                      Scheme = &quot;Bearer&quot;,
                      BearerFormat = &quot;JWT&quot;,
                      In = ParameterLocation.Header,
                      Description = &quot;JWT Authorization header using the Bearer scheme. \r\n\r\n Enter 'Bearer'[space] and then your token in the text input below.\r\n\r\nExample: \&quot;Bearer 12345abcdef\&quot;&quot;
                  });
                  swagger.AddSecurityRequirement(new OpenApiSecurityRequirement
                  {
                      {
                          new OpenApiSecurityScheme
                          {
                              Reference = new OpenApiReference
                              {
                                  Type = ReferenceType.SecurityScheme,
                                  Id = &quot;Bearer&quot;
                              }
                          },
                          new string[] {}
                      }
                  });
                  swagger.OperationFilter&lt;SwaggerDefaultValues&gt;();
                  swagger.OperationFilter&lt;AuthenticationRequirementOperationFilter&gt;();
  
                  // Set the comments path for the Swagger JSON and UI.
                  var xmlFile = $&quot;{Assembly.GetExecutingAssembly().GetName().Name}.xml&quot;;
                  var xmlPath = Path.Combine(AppContext.BaseDirectory, xmlFile);
                  swagger.IncludeXmlComments(xmlPath);
              });
              services.AddApiVersioning();
              services.AddVersionedApiExplorer(options =&gt;
              {
                  options.GroupNameFormat = &quot;'v'VVVV&quot;;
                  options.DefaultApiVersion = ApiVersion.Parse(&quot;0.6.alpha&quot;);
                  options.AssumeDefaultVersionWhenUnspecified = true;
              });
              services.AddTransient&lt;IConfigureOptions&lt;SwaggerGenOptions&gt;, ConfigureSwaggerOptions&gt;();
          }
  
          // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
          public void Configure(IApplicationBuilder app, IWebHostEnvironment env, IApiVersionDescriptionProvider provider)
          {
              if (env.IsDevelopment())
              {
                  app.UseDeveloperExceptionPage();
              }
              else
              {
                  app.UseExceptionHandler(&quot;/Error&quot;);
                  // The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.
                  app.UseHsts();
              }
  
              app.UseHttpsRedirection();
              app.UseStaticFiles();
  
              // Enable middleware to serve generated Swagger as a JSON endpoint.
              app.UseSwagger();
  
              // Enable middleware to serve swagger-ui (HTML, JS, CSS, etc.),
              // specifying the Swagger JSON endpoint.
              app.UseSwaggerUI(c =&gt;
              {               
                  c.DisplayOperationId();
                  var versionDescription = provider.ApiVersionDescriptions;
                  foreach (var description in provider.ApiVersionDescriptions.OrderByDescending(_ =&gt; _.ApiVersion))
                  {
                      c.SwaggerEndpoint($&quot;/swagger/{description.GroupName}/swagger.json&quot;, $&quot;MRM2 Identity API {description.GroupName}&quot;);
                  }
              });
  
              app.UseRouting();
  
              app.UseAuthentication();
  
              app.UseAuthorization();
  
              app.UseEndpoints(endpoints =&gt;
              {
                  endpoints.MapControllers();
              });
          }
  </code></pre>
  <p>AuthorizationController.cs:</p>
  <pre><code>[Route(&quot;api/[controller]/[action]&quot;)]
      [ApiController]
      [ApiVersion(&quot;0.8.alpha&quot;)]
      [Produces(MediaTypeNames.Application.Json)]
      [Consumes(MediaTypeNames.Application.Json)]
      public class AuthorizationController : ControllerBase
      {
          private readonly IConfiguration _configuration;
          private readonly IdentDbContext _context;
          private readonly ApplicationUserManager _userManager;
          private readonly ApplicationRoleManager _roleManager;
          private readonly IGenerateTokens _tokens;
          private readonly IOpenIddictApplicationManager _applicationManager;
          private readonly IOpenIddictAuthorizationManager _authorizationManager;
          private readonly IOpenIddictScopeManager _scopeManager;
          private readonly SignInManager&lt;ApplicationUsers&gt; _signInManager;
          private HttpClient _client;
  
          public AuthorizationController(IConfiguration configuration, IdentDbContext context, ApplicationUserManager userManager, 
              ApplicationRoleManager roleManager, IGenerateTokens tokens, IOpenIddictApplicationManager applicationManager, IOpenIddictAuthorizationManager authorizationManager,
              IOpenIddictScopeManager scopeManager, SignInManager&lt;ApplicationUsers&gt; signInManager)
          {            
              _configuration = configuration;
              _context = context;
              _userManager = userManager;
              _roleManager = roleManager;
              _tokens = tokens;
              _applicationManager = applicationManager;
              _authorizationManager = authorizationManager;
              _scopeManager = scopeManager;
              _signInManager = signInManager;
          }
          
  
  
  
          [HttpPost(&quot;/token&quot;), Produces(&quot;application/json&quot;)]
          public async Task&lt;IActionResult&gt; Exchange()
          {
              var request = HttpContext.GetOpenIddictServerRequest() ??
                  throw new InvalidOperationException(&quot;The OpenID Connect request cannot be retrieved.&quot;);  //does not even hit this breakpoint.
  
              ClaimsPrincipal claimsPrincipal;
              
  
              if (request.IsPasswordGrantType())
              {
                  var user = await _userManager.FindByNameAsync(request.Username);                
                  
                  var roleList = await _userManager.GetRolesListAsync(user);
                  var databaseList = await _userManager.GetDatabasesAsync(user);
                  string symKey = _configuration[&quot;Jwt:Symmetrical:Key&quot;];
                  string jwtSub = _configuration[&quot;Jwt:Subject&quot;];
                  string issuer = _configuration[&quot;Jwt:Issuer&quot;];
                  string audience = _configuration[&quot;Jwt:Audience&quot;];
  
                  var claims = new List&lt;Claim&gt;
                  {
                      new Claim(JwtRegisteredClaimNames.Sub, jwtSub, issuer),
                      new Claim(ClaimTypes.NameIdentifier, user.Id.ToString(), issuer),
                      new Claim(ClaimTypes.Name, user.UserName, issuer)
                  };
  
                  foreach (var role in roleList)
                  {
                      claims.Add(new Claim(ClaimTypes.Role, role.Name));
                  }
  
                  foreach (var database in databaseList)
                  {
                      claims.Add(new Claim(type: &quot;DatabaseName&quot;, database));
                  }
                  var identity = new ClaimsIdentity(OpenIddictServerAspNetCoreDefaults.AuthenticationScheme);
                  identity.AddClaim(OpenIddictConstants.Claims.Name, user.UserName, OpenIddictConstants.Destinations.AccessToken);
                  identity.AddClaim(OpenIddictConstants.Claims.Subject, jwtSub, OpenIddictConstants.Destinations.AccessToken);
                  identity.AddClaim(OpenIddictConstants.Claims.Audience, audience, OpenIddictConstants.Destinations.AccessToken);
                  foreach (var cl in claims)
                  {
                      identity.AddClaim(cl.Type, cl.Value, OpenIddictConstants.Destinations.AccessToken);                    
                  }
  
                  claimsPrincipal = new ClaimsPrincipal(identity);
                  
              }
  
              if (request.IsAuthorizationCodeGrantType() || request.IsRefreshTokenGrantType())
              {
                  // Retrieve the claims principal stored in the authorization code/device code/refresh token.
                  var principal = (await HttpContext.AuthenticateAsync(OpenIddictServerAspNetCoreDefaults.AuthenticationScheme)).Principal;
  
                  // Retrieve the user profile corresponding to the authorization code/refresh token.
                  // Note: if you want to automatically invalidate the authorization code/refresh token
                  // when the user password/roles change, use the following line instead:
                  // var user = _signInManager.ValidateSecurityStampAsync(info.Principal);
                  var user = await _userManager.GetUserAsync(principal);
                  if (user == null)
                  {
                      return Forbid(
                          authenticationSchemes: OpenIddictServerAspNetCoreDefaults.AuthenticationScheme,
                          properties: new AuthenticationProperties(new Dictionary&lt;string, string&gt;
                          {
                              [OpenIddictServerAspNetCoreConstants.Properties.Error] = Errors.InvalidGrant,
                              [OpenIddictServerAspNetCoreConstants.Properties.ErrorDescription] = &quot;The token is no longer valid.&quot;
                          }));
                  }
  
                  // Ensure the user is still allowed to sign in.
                  if (!await _signInManager.CanSignInAsync(user))
                  {
                      return Forbid(
                          authenticationSchemes: OpenIddictServerAspNetCoreDefaults.AuthenticationScheme,
                          properties: new AuthenticationProperties(new Dictionary&lt;string, string&gt;
                          {
                              [OpenIddictServerAspNetCoreConstants.Properties.Error] = Errors.InvalidGrant,
                              [OpenIddictServerAspNetCoreConstants.Properties.ErrorDescription] = &quot;The user is no longer allowed to sign in.&quot;
                          }));
                  }
  
                  foreach (var claim in principal.Claims)
                  {
                      claim.SetDestinations(GetDestinations(claim, principal));
                  }
  
                  // Returning a SignInResult will ask OpenIddict to issue the appropriate access/identity tokens.
                  return SignIn(principal, OpenIddictServerAspNetCoreDefaults.AuthenticationScheme);
              }
  
              throw new InvalidOperationException(&quot;The specified grant type is not supported.&quot;);
          }
  
          private IEnumerable&lt;string&gt; GetDestinations(Claim claim, ClaimsPrincipal principal)
          {
              // Note: by default, claims are NOT automatically included in the access and identity tokens.
              // To allow OpenIddict to serialize them, you must attach them a destination, that specifies
              // whether they should be included in access tokens, in identity tokens or in both.
  
              switch (claim.Type)
              {
                  case Claims.Name:
                      yield return Destinations.AccessToken;
  
                      if (principal.HasScope(Scopes.Profile))
                          yield return Destinations.IdentityToken;
  
                      yield break;
  
                  case Claims.Email:
                      yield return Destinations.AccessToken;
  
                      if (principal.HasScope(Scopes.Email))
                          yield return Destinations.IdentityToken;
  
                      yield break;
  
                  case Claims.Role:
                      yield return Destinations.AccessToken;
  
                      if (principal.HasScope(Scopes.Roles))
                          yield return Destinations.IdentityToken;
  
                      yield break;
  
                  // Never include the security stamp in the access and identity tokens, as it's a secret value.
                  case &quot;AspNet.Identity.SecurityStamp&quot;: yield break;
  
                  default:
                      yield return Destinations.AccessToken;
                      yield break;
              }
          } 
      }
  </code></pre>
  <p>Here is how I have postman set for this, you can see the 415 return<a href="https://i.stack.imgur.com/Rsdrc.jpg" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/Rsdrc.jpg" alt="enter image description here" /></a></p>
  <p>Not sure what I missed in the setup, but I am receiving conflicting information, plus I want to troubleshoot the controller to determine what else I need to finish off the controller and ensure I am getting the information that I is needed for the rest of the program.  The 415 is not allowing me to troubleshoot the issue, but something is saying that the information is correct?</p>