title: OAuth Calling TokenEndpointPath results in The controller for path was not found
body: <p>Followed <a href="http://bitoftech.net/2015/02/03/asp-net-identity-2-accounts-confirmation-password-user-policy-configuration/" rel="nofollow noreferrer">this</a> manual and built token authentication. It works perfectly in the debug mode but in the release mode a call to the TokenEndpointPath results in </p>
  
  <blockquote>
    <p>The controller for path '/bps/oauth/token' was not found or does not
    implement IController.</p>
  </blockquote>
  
  <p>The URI has the /bps/ part because of the WebBaseUri in the Web.config file.</p>
  
  <pre><code>&lt;appSettings&gt;
  &lt;add key="WebBaseUrl" value="/bps/" /&gt;
  &lt;add key="WebApiBaseUrl" value="/api/" /&gt;
  &lt;add key="owin:AutomaticAppStartup" value="true" /&gt;
  &lt;add key="LoginErrorMessage" value="Login or email is wrong" /&gt;
  </code></pre>
  
  <p>The Startup class is following:</p>
  
  <pre><code>    public class Startup
  {
      public void Configuration(IAppBuilder app)
      {
          app.Use&lt;OwinExceptionHandlerMiddleware&gt;();
  
          var container = new WindsorContainer().Install(new WindsorInstaller());
          container.Register(Component.For&lt;IAppBuilder&gt;().Instance(app));
          var httpDependencyResolver = new WindsorHttpDependencyResolver(container);
  
          HttpConfiguration config = new HttpConfiguration();
          config.MapHttpAttributeRoutes();
  
          config.DependencyResolver = httpDependencyResolver;
          app.CreatePerOwinContext(() =&gt; container.Resolve&lt;ApplicationUserManager&gt;());
          GlobalConfiguration.Configuration.Services.Replace(typeof(IHttpControllerActivator), new WindsorControllerActivator(container));
  
  
          ConfigureOAuthTokenGeneration(app, container);
  
          ConfigureOAuthTokenConsumption(app);
  
          app.UseWebApi(config);
      }
  
      private void ConfigureOAuthTokenGeneration(IAppBuilder app, IWindsorContainer container)
      {
          var OAuthServerOptions = new OAuthAuthorizationServerOptions
          {
              //For Dev enviroment only (on production should be AllowInsecureHttp = false)
              AllowInsecureHttp = true,
              TokenEndpointPath = new PathString("/oauth/token"),
              AccessTokenExpireTimeSpan = TimeSpan.FromDays(1),
              Provider = container.Resolve&lt;IOAuthAuthorizationServerProvider&gt;(),
              AccessTokenFormat = container.Resolve&lt;CustomJwtFormat&gt;(),
          };
  
          app.UseOAuthAuthorizationServer(OAuthServerOptions);
      }
  
      private void ConfigureOAuthTokenConsumption(IAppBuilder app)
      {
          var issuer = ConfigurationManager.AppSettings["ServerAddress"];
          string audienceId = ConfigurationManager.AppSettings["AudienceId"];
          byte[] audienceSecret = TextEncodings.Base64Url.Decode(ConfigurationManager.AppSettings["AudienceSecret"]);
  
          // Api controllers with an [Authorize] attribute will be validated with JWT
          app.UseJwtBearerAuthentication(
              new JwtBearerAuthenticationOptions
              {
                  AuthenticationMode = AuthenticationMode.Active,
                  AllowedAudiences = new[] { audienceId },
                  IssuerSecurityTokenProviders = new IIssuerSecurityTokenProvider[]
                  {
                      new SymmetricKeyIssuerSecurityTokenProvider(issuer, audienceSecret)
                  }
              });
      }
  }
  </code></pre>
  
  <p>This is the implementation of the IOAuthAuthorizationServerProvider that's being resolved for the <strong>Provider</strong> property:</p>
  
  <pre><code>    public class OAuthService : OAuthAuthorizationServerProvider
  {
      private readonly IApplicationUserService _userService;
      private readonly ICredentialsValidatior _credentialsValidatior;
  
      public OAuthService(IApplicationUserService userService, ICredentialsValidatior credentialsValidatior)
      {
          this._userService = userService;
          _credentialsValidatior = credentialsValidatior;
      }
  
      public override Task ValidateClientAuthentication(OAuthValidateClientAuthenticationContext context)
      {
          context.Validated();
          return Task.FromResult&lt;object&gt;(null);
      }
  
      public override async Task GrantResourceOwnerCredentials(OAuthGrantResourceOwnerCredentialsContext context)
      {
          var allowedOrigin = context.OwinContext.Get&lt;string&gt;("as:clientAllowedOrigin");
          if (allowedOrigin == null) allowedOrigin = "*";
          context.OwinContext.Response.Headers.Add("Access-Control-Allow-Origin", new[] { allowedOrigin });
  
          /* Some user validation logick */
  
          var user = await _userService.FindByNameAsync(context.UserName);
  
          ClaimsIdentity oAuthIdentity = await GenerateUserIdentityAsync(user);
  
          var ticket = new AuthenticationTicket(oAuthIdentity, null);
  
          context.Validated(ticket);
      }
  
      private async Task&lt;ClaimsIdentity&gt; GenerateUserIdentityAsync(ApplicationUser user)
      {
          const string authenticationType = "JWT";
          var userIdentity = await _userService.CreateIdentityAsync(user, authenticationType);
  
          return userIdentity;
      }
  }
  </code></pre>
  
  <p>Class that's being resolved for the <strong>AccessTokenFormat</strong> property:</p>
  
  <pre><code>    public class CustomJwtFormat : ISecureDataFormat&lt;AuthenticationTicket&gt;
  {
      private readonly string _issuer;
  
      public CustomJwtFormat(string issuer)
      {
          _issuer = issuer;
      }
  
      public string Protect(AuthenticationTicket data)
      {
          if (data == null)
          {
              throw new ArgumentNullException("data");
          }
  
          string audienceId = ConfigurationManager.AppSettings["AudienceId"];
  
          string symmetricKeyAsBase64 = ConfigurationManager.AppSettings["AudienceSecret"];
  
          var keyByteArray = TextEncodings.Base64Url.Decode(symmetricKeyAsBase64);
  
          var signingKey = new HmacSigningCredentials(keyByteArray);
  
          var issued = data.Properties.IssuedUtc;
  
          var expires = data.Properties.ExpiresUtc;
  
          var token = new JwtSecurityToken(_issuer, audienceId, data.Identity.Claims, issued.Value.UtcDateTime, expires.Value.UtcDateTime, signingKey);
  
          var handler = new JwtSecurityTokenHandler();
  
          var jwt = handler.WriteToken(token);
  
          return jwt;
      }
  
      public AuthenticationTicket Unprotect(string protectedText)
      {
          throw new NotImplementedException();
      }
  }
  </code></pre>
  
  <p>This code is run on my local machine and works fine in the Debug and Release mode.</p>
  
  <p>The problem occurs when this code is published to the development server in debug mode.</p>
  
  <p>I found out that switching the <strong>AllowInsecureHttp</strong> property to false on the local machine leads to this error but the version on the dev server is exactly the same. I checked the IL code and the <strong>AllowInsecureHttp</strong> property there is set to 1.</p>
  
  <p><strong>UPDATE</strong></p>
  
  <p>I tried to add the /bps/ part to the TokenEndpointPath but it didn't help.</p>
  
  <p>For unknown reason now it doesn't work even locally.
  I found out that project's settings are such 
  <a href="https://i.stack.imgur.com/j6Ro8.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/j6Ro8.png" alt="enter image description here"></a></p>
  
  <p>I tried to find these settings on the dev server, unfortunately, because of the lack of my knowledge about IIS, I didn't find anything.</p>
  
  <p>I also tried to check the OWIN pipeline and found out that URL that's being passed through the pipeline is the same that's configured in the Startup.cs.</p>
  
  <p><a href="https://i.stack.imgur.com/gXEro.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/gXEro.png" alt="enter image description here"></a></p>
  
  <p>I also found <a href="https://stackoverflow.com/questions/32853803/asp-net-web-api-owin-tokenendpointpath-not-working-in-iis">this</a> question on the StackOverflow.</p>