Hi @igalfsg , @coding-flamingo

Thank you for this sample project and YouTube video ... it has been of great help. I am stuck with a very specific requirement related to Okta, and hoping you would be able to guide.

Due to policies, we are not allowed to the use the default org level Okta audience - api://default

When an application is created in Okta, Okta creates an application specific audience - this value is available in the Application Sign On Tab => OpenID Connect ID Token section. Typically, this Audience value is same as the Application Client ID. Due to policies, we are supposed to use this audience for Bearer token generation to any call backend APIs.

After upgrading your project to .NET 7 version, on the Client application, I am specifying this Audience using AdditionalProviderParameters.

builder.Services.AddOidcAuthentication(options =>
            {
                options.ProviderOptions.Authority = builder.Configuration.GetValue<string>("Okta:Authority");
                options.ProviderOptions.ClientId = builder.Configuration.GetValue<string>("Okta:ClientId");
                options.ProviderOptions.ResponseType = "code";
                options.ProviderOptions.DefaultScopes.Add("profile");
                options.ProviderOptions.DefaultScopes.Add("address");
                options.ProviderOptions.DefaultScopes.Add("email");
                options.ProviderOptions.AdditionalProviderParameters.Add("Audience", builder.Configuration.GetValue<string>("Okta:Audience"));
            });

And on the Server-side API project, I am enforcing for the same Audience value

services.AddAuthentication(options =>
                {
                    options.DefaultAuthenticateScheme = OktaDefaults.ApiAuthenticationScheme;
                    options.DefaultChallengeScheme = OktaDefaults.ApiAuthenticationScheme;
                    options.DefaultSignInScheme = OktaDefaults.ApiAuthenticationScheme;
                })
                .AddOktaWebApi(new OktaWebApiOptions()
                {
                    OktaDomain = Configuration["Okta:OktaDomain"],
                    Audience = Configuration["Okta:Audience"]
                });

However, when the API is invoked from the Client application, I am getting 401 Unauthorized with error : Bearer error="invalid_token", error_description="The audience 'api://default' is invalid"

When I decode the Bearer token being passed along with request using jwt.io, I am seeing the token is issued for Audience api://default

Please let me know if you have any suggestions on how to enforce the tokens to be issued with application specific audience, rather than the org wide audience value. Appreciate any possible help!