Identity server 4 Obtain role from token in webApi app

Question

I have correctly configured identity server 4 which authorizes a web api for method access. However, I cannot use the roles in the web api, the role is in the token but when it arrives on the web api it does not give me authorization to enter the api.

IDS4 Configuration

    new Client
                    {
                        ClientId = "spaclient",
                        ClientName = "SPA Client",
                        RequireConsent = false,
                        AllowedGrantTypes =  GrantTypes.ResourceOwnerPassword,
                        RequirePkce = true,
                        RequireClientSecret = false,
                        AllowAccessTokensViaBrowser = true,
                        AllowedScopes = new List<string>
                           {
                               IdentityServerConstants.StandardScopes.OpenId,
                               IdentityServerConstants.StandardScopes.Profile,
                               "role" 
                           }
                    }

 public static IEnumerable<ApiScope> ApiScopes =>
               new ApiScope[]
               {
              new ApiScope("spaclient", "SPA")
               };

            public static IEnumerable<ApiResource> ApiResources =>
              new ApiResource[]
              {
                new ApiResource("spaclient", "SPA")
              };

            public static IEnumerable<IdentityResource> IdentityResources =>
              new IdentityResource[]
              {
              new IdentityResources.OpenId(),
              new IdentityResources.Profile(),
               new IdentityResource("role","User Role", new List<string>() { "role" })
              };

CLIENT CONFIG

JwtSecurityTokenHandler.DefaultInboundClaimTypeMap.Clear();
            builder.Services.AddAuthentication("Bearer")
                    .AddJwtBearer("Bearer", options =>
                    {
                        options.Authority = "https://localhost:9002";  // --> IdentityServer Project
                        options.RequireHttpsMetadata = true;
                        options.SaveToken = true;
                        options.TokenValidationParameters = new TokenValidationParameters
                        {
                            ValidateAudience = false,
                            NameClaimType = "role",
                            RoleClaimType = "role"
                        };
                    });

CONTROLLER PART

    [HttpGet]
    [Authorize(Roles ="Administrator")] // <-- with role not work
    public IEnumerable<string> Get()
    {
        return new string[] { "value1", "value2" };
    }



 [HttpGet]
        [Authorize]<-- without role work fine
        public IEnumerable<string> Get()
        {
            return new string[] { "value1", "value2" };
        }

Answer 1

In your access token, there is no role claim. You need to configure your existing ApiScope or ApiResource to include the necessar role claim.

What you have done is to only include it in your ID-token.

see my answer here about the relationship between the various resource types in IdentityServer

To add a userclaim to your APIScope, like this:

new ApiScope(name: "spaclient",
displayName:"SPA",
userClaims: new List<string>{ "role" }),

Also, you must request the spaclient and openid scopes as well.

To control the token lifetimes:

var client2 = new Client
{
    ClientId = "authcodeflowclient", 
 
    IdentityTokenLifetime = 300,               //5 minutes
    AccessTokenLifetime = 3600,                //1 hour
    AuthorizationCodeLifetime = 300,           //5 minutes
    AbsoluteRefreshTokenLifetime = 2592000,    //30 days
    SlidingRefreshTokenLifetime = 1296000,     //15 days
    ...

To complement this answer, I write a blog post that goes into more detail about this topic: IdentityServer – IdentityResource vs. ApiResource vs. ApiScope