AddDownstreamWebApi fails after adding multiple auth schemes

Question

Problem: My as an app calls to a downstream web api throw a null exception error after adding my own jwt bearer authentication.

I have a .net 5 web API, call it AppAPI, whose ConfigureServices has the following code:

var accessTokenKey = Convert.FromBase64String(Configuration.GetValue<string>("AccessCodeSecret"));

        services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
               .AddJwtBearer("AccessToken", o =>
               {
                   o.RequireHttpsMetadata = false;
                   o.SaveToken = true;
                   o.TokenValidationParameters = new TokenValidationParameters
                   {
                       ValidateIssuerSigningKey = true,
                       IssuerSigningKey = new SymmetricSecurityKey(accessTokenKey),
                       ValidateIssuer = false,
                       ValidateAudience = false
                   };
               })
              .AddMicrosoftIdentityWebApi(Configuration, "AzureAd", "AzureAd")
              .EnableTokenAcquisitionToCallDownstreamApi()
              .AddDownstreamWebApi("CommonServicesApi", Configuration.GetSection("CommonServicesApi"))
              .AddInMemoryTokenCaches();

        //services.AddAuthorization();
        services.AddAuthorization(options =>
        {
            options.DefaultPolicy = new AuthorizationPolicyBuilder()
                .RequireAuthenticatedUser()
                .AddAuthenticationSchemes("AccessToken")
                .Build();
        });

I have an /auth endpoint that accepts an access token from Azure AD, and generates a new access token with my own custom claims based on the database. The controller uses an authorize attribute to ensure it uses the correct mechanism:

[Authorize(AuthenticationSchemes = "AzureAd")]

The default policy from above ensures the rest of the endpoints use this access token for every other endpoint that doesnt specify a scheme.

I have a 2nd web API, called CommonServices, that is only accessible from other APIs, not clients directly. So AppAPI uses AddDownstreamwebapi to handle those calls. This worked previously to me adding my own app access tokens, meaning I only had one auth mechanism - AddMicrosoftIdentityWebApi. I started receiving my error when I added my own JwtBearer auth - "AccessToken".

The controller that has the error injects IDownstreamWebApi commonServicesApi. It uses the default auth scheme of "AccessToken". The code looks like this:

 var response = await _commonServicesApi.CallWebApiForAppAsync("CommonServicesApi", "AzureAd",
             options => { options.RelativePath = "Projects"});
            var json = await response.Content.ReadAsStringAsync();

The 2nd parameter "AzureAd" was my attempt to have the commonservicesApi use the correct scheme. I am not even sure if that's the right scheme to use, or if .EnbleTokenAcquisitionToCallDownstreamApi adds a 3rd scheme that should be specified.

It is this call that I receive

System.NullReferenceException: 'Object reference not set to an instance of an object.'
at Microsoft.Identity.Web.MergedOptions.PrepareAuthorityInstanceForMsal()
This exception was originally thrown at this call stack:
Microsoft.Identity.Web.MergedOptions.PrepareAuthorityInstanceForMsal()
Microsoft.Identity.Web.TokenAcquisition.BuildConfidentialClientApplication(Microsoft.Identity.Web.MergedOptions)
Microsoft.Identity.Web.TokenAcquisition.GetOrBuildConfidentialClientApplication(Microsoft.Identity.Web.MergedOptions)
Microsoft.Identity.Web.TokenAcquisition.GetAuthenticationResultForAppAsync(string, string, string, Microsoft.Identity.Web.TokenAcquisitionOptions)
Microsoft.Identity.Web.DownstreamWebApi.CallWebApiForAppAsync(string, string, System.Action<Microsoft.Identity.Web.DownstreamWebApiOptions>, System.Net.Http.StringContent)
System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()

I can't seem to figure out what is null, or how to approach solving this problem.

AddDownstreamWebApi fails after adding multiple auth schemes

0 Answers0