MVC CodeFlowClient Manual sample fails with 401 or 403 about identityserver3.samples HOT 6 CLOSED

Does this help at all?

http://leastprivilege.com/2014/10/02/401-vs-403/

from identityserver3.samples.

It may, I will have to review. The main issue I am reporting is that the Sample code does not appear to work out of the box. If I had a working example, I think I could get my app to work. The main item I would like to verify is whether the access token returned from the token endpoint for the authorization code flow is correct and should look something like this:

"f71523f92b464fb5a232007aaf7df9e9"

For both my app and the MVC CodeFlowClient, the access token looks like the one above, which I don't think looks right (i..e not like the access token used in the implicit code flow example show above).

from identityserver3.samples.

Ok, I'll look at it. Thx.

from identityserver3.samples.

I believe I have debugged this. There seems to be two issues with the example code. First, the IdentityServer "Host" project has the "Client.cs" file with "codeclient" set to return an "AccessTokenType" of "AccessTokenType.Reference". Because of this, the token endpoint was always returned the another code and not the access token. By setting AccessTokenType within the "codeclient" to "AccessTokenType.Jwt", the first trip to IdentityServer was returning a code, as expected, and the second trip now returns a valid access token when "OAuth2Client.RequestAuthorizationCodeAsync" is called passing the code.

The 403 issue was exactly as stated in the article you referenced in your first post. "Profile" was not a valid scope so 403 was returned.

By changing the "Host" projects Client.cs file and removing "profile" from the scope, the code executes correctly.

from identityserver3.samples.

The sample works as expected - the reference token was by design - you can of course change it to Jwt - but this will make your cookie much bigger.

The service requires a scope of either "read" or "write" - so you need to request that on the first page to be able to access it.

from identityserver3.samples.

Thanks. I finally found my issue. After review of the latest version the "SelfHost (Minimal)" project, I realized I did not have AccessTokenValidationEndpoint enabled in my IIS version of IdentityServer. Enabling this allowed reference tokens to work. Who would have thought that!

Thanks for all your help and guidance.

from identityserver3.samples.