title: How to call Identity Server 4 with Postman for login
body: <p>I've a solution in Visual Studio 'TourManagement' which contains 2 projects of .Net core. One is IDP using Identity Server 4, second project is RESTful API of TourManagement secured by IDP project. My question is how can I call Identity Server 4 using Postman to get tokens and call TourManagement Bands API by passing these tokens in header return from identity server in postman? My code is below.</p>
  <p>Startup Class in IDP Project</p>
  <pre><code>using Microsoft.AspNetCore.Builder;
  using Microsoft.AspNetCore.Hosting;
  using Microsoft.Extensions.DependencyInjection;
  
  namespace Marvin.IDP
  {
      public class Startup
      {
          public void ConfigureServices(IServiceCollection services)
          {
              services.AddMvc();
  
              services.AddIdentityServer()
                  .AddDeveloperSigningCredential()
                  .AddTestUsers(Config.GetUsers())
                  .AddInMemoryApiResources(Config.GetApiResources())
                  .AddInMemoryIdentityResources(Config.GetIdentityResources())
                  .AddInMemoryClients(Config.GetClients());
  
              services.AddCors();
          }
  
          public void Configure(IApplicationBuilder app, IHostingEnvironment env)
          {
              if (env.IsDevelopment())
              {
                  app.UseDeveloperExceptionPage();
              }
  
              app.UseCors(c =&gt; c.AllowAnyOrigin().AllowAnyHeader().AllowAnyMethod());
  
              app.UseIdentityServer();
  
              app.UseStaticFiles();
              app.UseMvcWithDefaultRoute();
          }         
      }
  }
  </code></pre>
  <p>Config Class in IDP Project</p>
  <pre><code>using IdentityServer4;
  using IdentityServer4.Models;
  using IdentityServer4.Test;
  using System.Collections.Generic;
  using System.Security.Claims;
  
  namespace Marvin.IDP
  {
      public static class Config
      {
          public static List&lt;TestUser&gt; GetUsers()
          {
              return new List&lt;TestUser&gt;
              {
                  new TestUser
                  {
                      SubjectId = &quot;fec0a4d6-5830-4eb8-8024-272bd5d6d2bb&quot;,
                      Username = &quot;Jon&quot;,
                      Password = &quot;jon123&quot;,
                      Claims = new List&lt;Claim&gt;
                      {
                          new Claim(&quot;given_name&quot;, &quot;Jon&quot;),
                          new Claim(&quot;family_name&quot;, &quot;Doe&quot;),
                          new Claim(&quot;role&quot;, &quot;Administrator&quot;),
                      }
                  },
                  new TestUser
                  {
                      SubjectId = &quot;c3b7f625-c07f-4d7d-9be1-ddff8ff93b4d&quot;,
                      Username = &quot;Steve&quot;,
                      Password = &quot;steve123&quot;,
                      Claims = new List&lt;Claim&gt;
                      {
                          new Claim(&quot;given_name&quot;, &quot;Steve&quot;),
                          new Claim(&quot;family_name&quot;, &quot;Smith&quot;),
                          new Claim(&quot;role&quot;, &quot;Tour Manager&quot;),
                      }
                  }
              };
          }
  
          public static List&lt;IdentityResource&gt; GetIdentityResources()
          {
              return new List&lt;IdentityResource&gt;
              {
                 new IdentityResources.OpenId(),
                 new IdentityResources.Profile(),
                 new IdentityResource(&quot;roles&quot;, &quot;Your role(s)&quot;, new []{&quot;role&quot;}),
              };
          }
  
          internal static IEnumerable&lt;ApiResource&gt; GetApiResources()
          {
              return new[] {
                  new ApiResource(&quot;tourmanagementapi&quot;, &quot;Tour Management API&quot;, new[] { &quot;role&quot; })  
              };
          }
  
          public static List&lt;Client&gt; GetClients()
          {
              return new List&lt;Client&gt;
              {
                  new Client
                  {
                      ClientName = &quot;Tour Management&quot;,
                      ClientId=&quot;tourmanagementclient&quot;,
                      AllowedGrantTypes = GrantTypes.Implicit,
                      RequireConsent = false,
                      AllowAccessTokensViaBrowser = true,
                      RedirectUris =new List&lt;string&gt;
                      {
                          &quot;https://localhost:4200/signin-oidc&quot;,
                          &quot;https://localhost:4200/redirect-silentrenew&quot;
                      },
                      AccessTokenLifetime = 180,
                      PostLogoutRedirectUris = new[]{
                          &quot;https://localhost:4200/&quot; },
                      AllowedScopes = new []
                      {
                          IdentityServerConstants.StandardScopes.OpenId,
                          IdentityServerConstants.StandardScopes.Profile,
                          &quot;roles&quot;,
                          &quot;tourmanagementapi&quot;,
                      }
                  }
              };
          }
      }
  }
  </code></pre>
  <p>Startup Class in TourManagement API Project</p>
  <pre><code>using IdentityServer4.AccessTokenValidation;
  using Microsoft.AspNetCore.Authorization;
  using Microsoft.AspNetCore.Builder;
  using Microsoft.AspNetCore.Hosting;
  using Microsoft.AspNetCore.Http;
  using Microsoft.AspNetCore.Mvc.Formatters;
  using Microsoft.EntityFrameworkCore;
  using Microsoft.Extensions.Configuration;
  using Microsoft.Extensions.DependencyInjection;
  using Newtonsoft.Json;
  using Newtonsoft.Json.Serialization;
  using System.Linq;
  using TourManagement.API.Authorization;
  using TourManagement.API.Services;
  
  namespace TourManagement.API
  {
      public class Startup
      {
          public Startup(IConfiguration configuration)
          {
              Configuration = configuration;
          }
  
          public IConfiguration Configuration { get; }
  
          public void ConfigureServices(IServiceCollection services)
          {
              services.AddAuthorization();
  
              services.AddScoped&lt;IAuthorizationHandler, UserMustBeTourManagerRequirementHandler&gt;();
  
              services.AddMvc(setupAction =&gt;
              {
                  setupAction.ReturnHttpNotAcceptable = true;
              })
              .AddJsonOptions(options =&gt;
              {
                  options.SerializerSettings.DateParseHandling = DateParseHandling.DateTimeOffset;
                  options.SerializerSettings.ContractResolver =
                      new CamelCasePropertyNamesContractResolver();
              });
  
           
              services.AddCors(options =&gt;
              {
                  options.AddPolicy(&quot;AllowAllOriginsHeadersAndMethods&quot;,
                      builder =&gt; builder.AllowAnyOrigin().AllowAnyHeader().AllowAnyMethod());
              });
  
              var connectionString = Configuration[&quot;ConnectionStrings:TourManagementDB&quot;];
              services.AddDbContext&lt;TourManagementContext&gt;(o =&gt; o.UseSqlServer(connectionString));
  
              services.AddScoped&lt;ITourManagementRepository, TourManagementRepository&gt;();
  
              services.AddSingleton&lt;IHttpContextAccessor, HttpContextAccessor&gt;();
  
              services.AddScoped&lt;IUserInfoService, UserInfoService&gt;();
  
              services.AddAuthentication(IdentityServerAuthenticationDefaults.AuthenticationScheme)
                  .AddIdentityServerAuthentication(options =&gt;
                  {
                      options.Authority = &quot;https://localhost:44398&quot;;
                      options.ApiName = &quot;tourmanagementapi&quot;;
                  });
  
          }
  
          public void Configure(IApplicationBuilder app, IHostingEnvironment env)
          {
              if (env.IsDevelopment())
              {
                  app.UseDeveloperExceptionPage();
              }
              else
              {
                  app.UseExceptionHandler(appBuilder =&gt;
                  {
                      appBuilder.Run(async context =&gt;
                      {
                          context.Response.StatusCode = 500;
                          await context.Response.WriteAsync(&quot;An unexpected fault happened. Try again later.&quot;);
                      });
                  });
              }
  
              app.UseCors(&quot;AllowAllOriginsHeadersAndMethods&quot;);
  
              app.UseAuthentication();
  
              app.UseMvc();
          }
      }
  }
  </code></pre>
  <p>Bands Controller in Tourmanagement API Project</p>
  <pre><code>using AutoMapper;
  using Microsoft.AspNetCore.Authorization;
  using Microsoft.AspNetCore.Mvc;
  using System.Collections.Generic;
  using System.Threading.Tasks;
  using TourManagement.API.Dtos;
  using TourManagement.API.Services;
  
  namespace TourManagement.API.Controllers
  {
      [Route(&quot;api/bands&quot;)]
      [Authorize]
      public class BandsController : Controller
      {
          private readonly ITourManagementRepository _tourManagementRepository;
  
          public BandsController(ITourManagementRepository tourManagementRepository)
          {
              _tourManagementRepository = tourManagementRepository;
          }
  
          [HttpGet]
          public async Task&lt;IActionResult&gt; GetBands()
          {
              var bandsFromRepo = await _tourManagementRepository.GetBands();
  
              var bands = Mapper.Map&lt;IEnumerable&lt;Band&gt;&gt;(bandsFromRepo);
  
              return Ok(bands);
          }
      }
  }
  
  </code></pre>