title: ASP.NET JSON Web Token "401 Unauthorized"
body: <p>I'm using decoupled resource and authentication servers.
  When I successfully get JSON Web Token, I check it with jwt.io and everything is ok with token format and it's secret. </p>
  
  <p>Request is with authorization header:</p>
  
  <pre><code>Authorization: Bearer TOKEN_HERE
  </code></pre>
  
  <p>Response is always "401 Unauthorized":</p>
  
  <pre><code>{
    "message": "Authorization has been denied for this request."
  }
  </code></pre>
  
  <p>Here is my Startup.cs from resource server</p>
  
  <pre><code>using Microsoft.Owin;
  using Microsoft.Owin.Cors;
  using Microsoft.Owin.Security;
  using Microsoft.Owin.Security.Jwt;
  using Newtonsoft.Json.Serialization;
  using Owin;
  using System.Web.Http;
  using Test.Database;
  using Test.Infrastructure;
  using Microsoft.WindowsAzure.ServiceRuntime;
  
  [assembly: OwinStartup(typeof(Test.API.Startup))]
  namespace Custodesk.API
  {
      public class Startup
      {
          public void Configuration(IAppBuilder app)
          {
              app.CreatePerOwinContext(() =&gt; 
                  ApplicationDbContext.Create(RoleEnvironment.GetConfigurationSettingValue("SqlConnectionString")));
              app.CreatePerOwinContext&lt;ApplicationUserManager&gt;(ApplicationUserManager.Create);
  
              GlobalConfiguration.Configuration.SuppressDefaultHostAuthentication();
  
              ConfigureOAuthTokenConsumption(app);
  
              GlobalConfiguration.Configure(config =&gt;
              {
                  //global filters
                  config.Filters.Add(new AuthorizeAttribute());
  
                  // Web API routes
                  config.MapHttpAttributeRoutes();
                  config.Routes.MapHttpRoute(
                      name: "DefaultApi",
                      routeTemplate: "{controller}/{action}/{id}",
                      defaults: new { id = RouteParameter.Optional }
                  );
  
                  config.Formatters.JsonFormatter.SerializerSettings.ContractResolver = new CamelCasePropertyNamesContractResolver();
              });
  
              app.UseCors(CorsOptions.AllowAll);
  
              app.UseWebApi(GlobalConfiguration.Configuration);
          }
  
          private void ConfigureOAuthTokenConsumption(IAppBuilder app)
          {
              var issuer = "http://localhost";
              var audience = "Universal_application";
              var secret = Helper.GetHash("helper_class_to_get_the_same_hash_as_authentication_server");
  
              // Api controllers with an [Authorize] attribute will be validated with JWT
              app.UseJwtBearerAuthentication(
                  new JwtBearerAuthenticationOptions
                  {
                      AuthenticationMode = AuthenticationMode.Active,
                      AllowedAudiences = new[] { audience },
                      IssuerSecurityTokenProviders = new IIssuerSecurityTokenProvider[]
                      {
                          new SymmetricKeyIssuerSecurityTokenProvider(issuer, secret)
                      }
                  });
  
          }
      }
  }
  </code></pre>
  
  <p>Here is an example of token decrypted:</p>
  
  <pre><code>{
    "typ": "JWT",
    "alg": "HS256"
  }
  {
    "nameid": "b22a825e-60ce-45ed-b2cb-b2ee46a47936",
    "unique_name": "begunini",
    "role": [
      "Owner",
      "Admin",
      "ManagerViewer"
    ],
    "iss": "http://localhost",
    "aud": "Universal_application",
    "exp": 1454876502,
    "nbf": 1454876202
  }
  </code></pre>
  
  <p>I've checked the Secret and it's the same on both sides (auth and resource servers).
  Audience matches, issuer also.
  Already tried to downgrade System.IdentityModel.Tokens.Jwt to version 3.0.2 but no luck</p>
  
  <p>I guess there is some problem in Configuration order, but nothing helped.</p>
  
  <p>Any ideas ?</p>