This does not work about auth0-aspnetcore-webapi-samples

[frederikprijck]

Thanks for reaching out.

When I run the sample application, and call the private-scoped endpoint with a token, set as the Authorization header, that has the read:messages scope, I am able to get to the controller successfully and the scopes are found in the HasScopeHandler:

Have you verified your token contains the required scopes? You can use www.jwt.io to decode your token and look at its scope property, you should see something like this:

[DasNaughtie]

Hi Frederickprijck,

Thanks for getting back to me.

I've opted to use the RBAC option so have checked that an can confirm the permissions are visible in the token. However, when I attempt to debug I don't see any claims at all:

so at a bit of a loss.

[DasNaughtie]

In this case I've used postman to get a token and then tried to hit a protected endpoint on my local.

[frederikprijck]

Thanks for sharing that, it does work for me when I use RBAC and check for the permissions claim.

A bit weird to not have any claims at all, as well as for isAuthenticated to be false. There must be something else going on, it typically means you are not sending a token, or the token is expired.

Did you verify that exact JWT token is not expired, contains the correct audience and are sending it using the Authorization: Bearer TOKEN_HERE header?

[DasNaughtie]

I know...I'm at a bit of a loss myself.

I've checked the details of the token on jwt.io and everything seems to be in order. And definitely adding it as a Authorization header in Postman but still coming through empty when it hits my handler.

[DasNaughtie]

Any ideas?

[frederikprijck]

I'm sorry, but there isn't much we can help with based on the information provided.

If the user is marked as not authenticated, and there is no claim set, I believe we shouldn't focus on the permissions claims or the Handler, but try and figure out why the token isn't being accepted.

Things I can think of (but have already mentioned) are:

• Ensure audience in the API project is the same as in the token
• Ensure the domain is correct in the API project
• Ensure you sent a non expired token

Can you reproduce the behavior you are experiencing with our Sample app?

[DasNaughtie]

Just found out from one of the UI team that they've added a Rule to Auth0 pipeline:

Can't see why this would affect my local but thought I'd ask all the same.
I'll try to give it a test with you sample and let you know how I get along.

[DasNaughtie]

Hi there....
Downloaded your sample and it worked first time so the issue is definitely with my implementation. Going to see if I can get to the bottom of the issue...if I do then will post here at least for future reference should anyone else ask about or come across this in future.

[frederikprijck]

Thanks, let me know if I can still help.

Closing this for now, but happy to reopen as needed.