Nrthugu

I have been fiddling around with IDS 4 and I have a small problem. I set my token life times to about 15 seconds and even though they are expired I can still retrieve date from my resource server. If I remove the token from my header on the client call I get a 401 error.

Client

    [Authorize]

    public async Task<ActionResult> Shouts()

    {



        var accessToken = await HttpContext.GetTokenAsync("access_token");

        var tokenh = new JwtSecurityTokenHandler();



        var jwtSecurityToken= tokenh.ReadJwtToken(accessToken);



        var val = jwtSecurityToken.ValidTo;







        using (var client = new HttpClient())

        {



            client.DefaultRequestHeaders.Authorization = new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", accessToken);

            var rawResponse = await client.GetAsync("http://localhost:5002/api/Values/Get");



            if (rawResponse.StatusCode == System.Net.HttpStatusCode.Unauthorized)

            {

                var refreshSucc = await this.RefreshTokensAsync(this.HttpContext);

                if (!refreshSucc)

                {

                    var authServerInfo = await this.GetAuthenticationServerInfo();

                    return Redirect(authServerInfo.AuthorizeEndpoint);

                }

            }



            var response = await (rawResponse).Content.ReadAsStringAsync();

            var data = JsonConvert.DeserializeObject<List<String>>(response);

            return View("Shouts", data);

        }

    }

    public class Startup

    {

        public Startup(IConfiguration configuration)

        {

            Configuration = configuration;

        }



        public IConfiguration Configuration { get; }



        // This method gets called by the runtime. Use this method to add services to the container.

        public void ConfigureServices(IServiceCollection services)

        {



            JwtSecurityTokenHandler.DefaultInboundClaimTypeMap.Clear();

            services.AddAuthentication(options =>

            {                

                options.DefaultScheme = "Cookies";

                options.DefaultChallengeScheme = "oidc";                

            })

                .AddCookie("Cookies",o=>o.LogoutPath="/home/logout")

                .AddOpenIdConnect("oidc", opt => 

                {

                    opt.SignInScheme = "Cookies";

                    opt.Authority = "http://localhost:5000";

                    opt.RequireHttpsMetadata = false;

                    opt.ClientId = "AuthTest_Code";

                    opt.ClientSecret = "secret";

                    opt.ResponseType = "id_token code";

                    opt.Scope.Add("TestAPI");

                    opt.Scope.Add("offline_access");

                    opt.Scope.Add("email");

                    opt.GetClaimsFromUserInfoEndpoint = true;

                    opt.SaveTokens = true;                    

                });

            services.AddMvc();

        }



        // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.

        public void Configure(IApplicationBuilder app, IHostingEnvironment env)

        {

            if (env.IsDevelopment())

            {

                app.UseBrowserLink();

                app.UseDeveloperExceptionPage();

            }

            else

            {

                app.UseExceptionHandler("/Home/Error");

            }



            app.UseStaticFiles();



            app.UseAuthentication();



            app.UseMvc(routes =>

            {

                routes.MapRoute(

                    name: "default",

                    template: "{controller=Home}/{action=Index}/{id?}");

            });

        }

    }

Auth Server

    public static IEnumerable<Client> GetClients()

    {

        return new List<Client>

        {              

               new Client

            {

                ClientId = "AuthTest_Code",

                ClientSecrets=new {new Secret("secret".Sha256()) },

                AllowedGrantTypes = GrantTypes.Hybrid,

                AllowedScopes = new List<string>

                {

                    IdentityServerConstants.StandardScopes.OpenId,

                    IdentityServerConstants.StandardScopes.Profile,

                    IdentityServerConstants.StandardScopes.Email,                        

                    "TestAPI"

                },

                AllowAccessTokensViaBrowser=true,

                AllowOfflineAccess=true,

                RedirectUris = new  { "http://localhost:5001/signin-oidc" },

                PostLogoutRedirectUris={ "http://localhost:5001/signout-callback-odic"},

                RequireConsent=false,

                AccessTokenLifetime=15,

                AbsoluteRefreshTokenLifetime=15

            }

        };

    }



public class Startup

{

    public IHostingEnvironment Environment { get; }



    public Startup(IHostingEnvironment environment)

    {

        Environment = environment;

    }

    // This method gets called by the runtime. Use this method to add services to the container.

    // For more information on how to configure your application, visit https://go.microsoft.com/fwlink/?LinkID=398940

    public void ConfigureServices(IServiceCollection services)

    {

        var isServer = services.AddIdentityServer()                

            .AddSigningCredential(new X509Certificate2(@"C:OpenSSLCertsAuthenticate.pfx", "Password1"))

            .AddInMemoryApiResources(TestConfig.GetApis())

            .AddInMemoryClients(TestConfig.GetClients())

            .AddInMemoryIdentityResources(TestConfig.GetIdentityResources())

            .AddTestUsers(TestConfig.GetUsers());





        services.AddMvc();

    }



    // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.

    public void Configure(IApplicationBuilder app, IHostingEnvironment env)

    {

        if (Environment.IsDevelopment())

        {

            app.UseDeveloperExceptionPage();

        }



        app.UseIdentityServer();



        app.UseStaticFiles();



        app.UseMvcWithDefaultRoute();

    }

}

Resource Server

using System;

using System.Collections.Generic;

using System.Linq;

using System.Threading.Tasks;

using Microsoft.AspNetCore.Builder;

using Microsoft.AspNetCore.Hosting;

using Microsoft.AspNetCore.Http;

using Microsoft.Extensions.DependencyInjection;



namespace ResourceAPI

{

    public class Startup

    {

        // This method gets called by the runtime. Use this method to add services to the container.

        // For more information on how to configure your application, visit https://go.microsoft.com/fwlink/?LinkID=398940

        public void ConfigureServices(IServiceCollection services)

        {

            services.AddMvcCore()

                .AddAuthorization()

                .AddJsonFormatters();



            services.AddAuthentication("Bearer")                

                .AddIdentityServerAuthentication(options =>

                {

                    options.Authority = "http://localhost:5000";

                    options.RequireHttpsMetadata = false;                    

                    options.ApiName = "TestAPI";                    

                });

        }



        // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.

        public void Configure(IApplicationBuilder app, IHostingEnvironment env)

        {

            app.UseAuthentication();

            app.UseMvc();

        }

    }

}





    [Route("api/[controller]")]

    public class ValuesController:ControllerBase

    {

        [HttpGet]

        [Route("Get")]

        [Authorize]

        public async Task<IActionResult> Get()

        {

            var username = User.Claims.FirstOrDefault(t => t.Type == "email")?.Value;

            return Ok(new string { "value1", "value2" });

        }      

    }

Access Token:
eyJhbGciOiJSUzI1NiIsImtpZCI6IjQ0Q0Q4NjFEQjA0MzdEMUM4NUY2REU0MTIyMkFDOEIwMTE3M0Q2MTAiLCJ0eXAiOiJKV1QiLCJ4NXQiOiJSTTJHSGJCRGZSeUY5dDVCSWlySXNCRnoxaEEifQ.eyJuYmYiOjE1NDIxMjc4OTQsImV4cCI6MTU0MjEyNzkwOSwiaXNzIjoiaHR0cDovL2xvY2FsaG9zdDo1MDAwIiwiYXVkIjpbImh0dHA6Ly9sb2NhbGhvc3Q6NTAwMC9yZXNvdXJjZXMiLCJUZXN0QVBJIl0sImNsaWVudF9pZCI6IkF1dGhUZXN0X0NvZGUiLCJzdWIiOiIxIiwiYXV0aF90aW1lIjoxNTQyMTI3ODkzLCJpZHAiOiJsb2NhbCIsImVtYWlsIjoiRGF2aWRAQUJldHRlckxpZmUuY28uemEiLCJzY29wZSI6WyJvcGVuaWQiLCJwcm9maWxlIiwiZW1haWwiLCJUZXN0QVBJIiwib2ZmbGluZV9hY2Nlc3MiXSwiYW1yIjpbInB3ZCJdfQ.hNskjZz3IBqPg_5T0xVwYEP5RukcMt3l019PRp74vNBkiEr6FLvBADa_eylhNGA8qDd7SwyDkq6APaKxaNt0YybAChZvFW6pzLlfknVVHM1vuN7PDOX9PNGhFK9kSONBypXo6JqV3epactsmJvhr3FZxBSufUDRyV4j_YY3O8TCjJf_5UORc_3ox9clNdjt-Vx-BlcDjVbpBw2P76F3pq2IPPDM139H4qYcyaTzSlEbFd3EdVwO6O85bWM1G8yQ9zQAUk23It29oHxTtwsi5Wg4Zpmt7K7AlvKjKxKoxw_Y32QdBkGY9xU_KXOn4h0WJV3LG-InZc7BveLGHq6ncaQ

Try setting options.JwtValidationClockSkew property to zero in your web api(resource server)

   services.AddAuthentication("Bearer")

        .AddIdentityServerAuthentication(options =>

        {

            options.JwtValidationClockSkew = TimeSpan.Zero;

            options.Authority = "https://localhost:44323";

            options.RequireHttpsMetadata = false;



            options.ApiName = "api1";

        });

There is a clock skew in the Microsoft JWT validation middleware. It is set by default to 5 mins. And it's suggest to leave it as default (300 seconds/5 minutes).

This is most likely due to the default 5 minute (if memory serves) clock skew allowance. It is however possible to override this setting in IDS4 and the bearer token middleware.