IdentityServer4 and .NET Framework: access token validation about identityserver4.accesstokenvalidation HOT 7 CLOSED

The old access token validation endpoint is not supported in IS4 anymore.

Either switch to local validation - or if you are using reference tokens - configure a scope name and secret in the validation middleware to use introspection.

See here for our cross version compat tests:
https://github.com/IdentityServer/CrossVersionIntegrationTests

from identityserver4.accesstokenvalidation.

your last snippet looks good - that's thats needed.

from identityserver4.accesstokenvalidation.

Thank you @leastprivilege, some parts of that API use JWT tokens and some external parts use reference tokens, having said that won't I need both? And I think I got it working with just this:

services.AddAuthentication("Bearer")
                .AddIdentityServerAuthentication(options =>
                {
                    options.Authority = "http://localhost:5000";
                    options.RequireHttpsMetadata = false;
                    options.ApiName = "api1";
                    options.ApiSecret = "secret";
                })

Note in the above that I haven't used .ClientId as my external clients can be dynamically generated (which all use reference tokens). Is that the correct way of doing it?

from identityserver4.accesstokenvalidation.

Oh my god is working! Thanks a lot for what you're doing with this project. Usefull examples.

from identityserver4.accesstokenvalidation.

@leastprivilege I am using a reference token to invoke the API demonstrated in Quickstart1_ClientCredential but I keep getting an InternalServerError. I added this to my API startup.cs:ConfigureServices method hoping it would help but no luck, can you please help?

services.AddAuthentication("Bearer")
                .AddOAuth2Introspection(options =>
                {
                    options.Authority= "http://localhost:5000";
                    options.ClientSecret = "secret";
                    options.ClientId = "refclient";
                    options.IntrospectionEndpoint = "http://localhost:5000";
                })
                .AddIdentityServerAuthentication(options =>
                {
                    options.Authority = "http://localhost:5000";
                    options.RequireHttpsMetadata = false;

                    options.SupportedTokens = SupportedTokens.Both;
                    options.ApiName = "api1";
                });

from identityserver4.accesstokenvalidation.

for reference tokens this is all that's needed:

services.AddAuthentication("Bearer")
                .AddOAuth2Introspection(options =>
                {
                    options.Authority= "http://localhost:5000";
                    options.ClientSecret = "secret";
                    options.ClientId = "refclient";
                });
               

from identityserver4.accesstokenvalidation.

Oh my god is working! Thanks a lot for what you're doing with this project. Usefull examples.

What did your Configuration method end up looking. I spend most of the day trying to figure this out, so a working sample snippet would be great. The API samples are in .Net core, and not .Net 4.x and I need to implement IS4 in an old Classic .Net 4.6.2 application.

from identityserver4.accesstokenvalidation.