title: ASP.NET Core WebApi Jwt Role-based Authorization not working
body: <p>I have implemented a JWT Authentication/Authorization system based on a tutorial.</p>
  
  <p>But Unfortunately I have no idea how to authorize the roles.</p>
  
  <p>This is a role based authorizaton.</p>
  
  <pre><code>    public class InfoController : ControllerBase
      {
          [Authorize(Roles = "User")]
          [HttpGet("user")]
          public IActionResult UserInfo()
          {
              return Ok("User role");
          }
      }
  </code></pre>
  
  <p>When I call this <code>api/Info/user</code> I get <strong>401</strong> response code instead of the Status code <strong>200</strong> with the "User role" message. So the role-based authorization does not work.
  I call it with the correct data:</p>
  
  <pre><code>curl -X GET "https://localhost:34545/api/Info/user" -H  "accept: application/json" -H  "Authorization: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ0ZXN0IiwianRpIjoiYTgwYzQ3NDQtNmYyZC00ZTAwLThhYjItMzY2MTRmYTNmMzYzIiwiaWF0IjoxNTU3NjgyMDU4LCJyb2wiOiJ3ZWItYXBpLWFjYyIsImh0dHA6Ly9zY2hlbWFzLm1pY3Jvc29mdC5jb20vd3MvMjAwOC8wNi9pZGVudGl0eS9jbGFpbXMvcm9sZSI6IlVzZXIiLCJuYmYiOjE1NTc2ODIwNTgsImV4cCI6MTU1NzY4OTI1OCwiaXNzIjoid2ViLWFwaSIsImF1ZCI6Imh0dHBzOi8vbG9jYWxob3N0OjQ0MzUwLyJ9.8uRAOsSXmKeWcYCwvN0sNFX02GNoZMaPNf6RPGkQE4E"
  </code></pre>
  
  <p>In the startup I has the following configuration:</p>
  
  <pre><code>services.AddAuthorization(options =&gt;
          {
              options.AddPolicy("api", policy =&gt; policy.RequireClaim(
                 jwtClaimConfiguration[nameof(JwtClaimOptions.Rol)],
                 jwtClaimConfiguration[nameof(JwtClaimOptions.ApiAccess)]
              ));
              options.AddPolicy("user", policy =&gt; policy.RequireRole(AppRole.USER));
              options.AddPolicy("admin", policy =&gt; policy.RequireRole(AppRole.ADMIN));
          });
  </code></pre>
  
  <p>Here where the Jwt generated (I have seen here StackOverflow this solution)</p>
  
  <pre><code> public async Task&lt;string&gt; GenerateEncodedTokenAsync(string userName, ClaimsIdentity claimsIdentity)
          {
              List&lt;Claim&gt; claims = new List&lt;Claim&gt;()
              {
                   new Claim(JwtRegisteredClaimNames.Sub, userName),
                   new Claim(JwtRegisteredClaimNames.Jti, await jwtOptions.JtiGenerator()),
                   new Claim(JwtRegisteredClaimNames.Iat, ToUnixEpochDate(jwtOptions.IssuedAt).ToString(), ClaimValueTypes.Integer64),
                   claimsIdentity.FindFirst(jwtClaimConfiguration[nameof(JwtClaimOptions.Rol)]),
                   claimsIdentity.FindFirst(jwtClaimConfiguration[nameof(JwtClaimOptions.ApiAccess)])
               };
              var user = await userManager.FindByNameAsync(userName);
              var roles = await userManager.GetRolesAsync(user);
  
              claims.AddRange(roles.Select(role =&gt; new Claim(ClaimsIdentity.DefaultRoleClaimType, role)));
  
              JwtSecurityToken jwt = new JwtSecurityToken(
                  issuer: jwtOptions.Issuer,
                  audience: jwtOptions.Audience,
                  notBefore: jwtOptions.NotBefore,
                  expires: jwtOptions.Expiration,
                  signingCredentials: jwtOptions.SigningCredentials,
                  claims: claims
              );
  
              return new JwtSecurityTokenHandler().WriteToken(jwt);
          }
  </code></pre>
  
  <p>The Jwt token contains the role! Here is the payload, as you can see the Role has been added, the user has the "User" role.:</p>
  
  <pre><code>{
    "sub": "demo",
    "jti": "a80c4744-6f2d-4e00-8ab2-36614fa3f363",
    "iat": 1557682058,
    "rol": "acc",
    "http://schemas.microsoft.com/ws/2008/06/identity/claims/role": "User",
    "nbf": 1557682058,
    "exp": 1557689258,
    "iss": "api",
    "aud": "https://localhost:34545/"
  }
  </code></pre>