Setting up VS 2022 ASP.Net Core Web API with Authentication working

David Downing 21

I have been trying to get my ASP.Net Core Web API working with an AAD app registration for authentication and I'm not able to authenticate using either the default Swagger page or Postman.

At this point, I'm just trying to get the WeatherForecast API working. Is there a full walk-through that explains setting up the App Registration and Creating the VS 2022 project that works?

I updated the Manifest and changed "allowPublicClient" to false.

My App Registration is as follows:

The Postman error is:

Thank you

1 answer

Bruce (SqlWork.com) 56,846 Reputation points

2022-06-23T02:02:00.873+00:00

See this tutorial for setting up postman

https://learn.microsoft.com/en-us/rest/api/servicebus/get-azure-active-directory-token

Here is one for swagger

https://www.c-sharpcorner.com/article/enable-oauth-2-authorization-using-azure-ad-and-swagger-in-net-5-0/

https://www.infoworld.com/article/3650668/implement-authorization-for-swagger-in-aspnet-core-6.html
Please sign in to rate this answer.

1 person found this answer helpful.
David Downing 21 Reputation points

2022-06-23T16:30:11.267+00:00

I'll go through the samples and see if I can get them working. The main issue I've found with getting authentication/authorization working using online samples is either the code is outdated (no longer supported by Microsoft) or setting up the App Registration for the Web API or Web App is incomplete.

In this case, I simply want my Web API (VS 2022 Web API project with Authentication) to work. Once its working, I want to be able to test new APIs using Postman.

If I am able to get the sample working, I'll accept this answer.

Yes I do understand the OAuth protocol... in Postman, I'm getting a token, but it fails to make the call with error: "Neither scope or roles claim was found in the bearer token...." The screenshot above includes the full error.

Thank you for the response.

Bruce (SqlWork.com) 56,846 Reputation points

2022-06-23T21:33:09.7+00:00

you need to decide how to get the access token (the token is typically good for about an hour)

a typical client would use the msal library to get a token.

https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/wiki

you have some options:

1) your website has a webpage that returns the token. that is add an openid authenticated webpage that prints the access token. you hit this with a browser and use as the bearer token in postman
2) a command line utility to do the above.
3) you understand the oauth protocol, and use postman to get the token.
Sign in to comment