API Response 401

[SkyQuant]

I fetched token which is also saved in local storage, but can't authorize for API call. Suppose I have to manually realize auth logic writing something to Startup.cs?

[capesean]

I've just run into this issue myself. Will let you know when it's fixed.

[SkyQuant]

@capesean, thanks in advance. Any assumptions in the moment?

[capesean]

@SkyQuant It's an issue on another repo, see here:
aspnet-contrib/AspNet.Security.OpenIdConnect.Server#232

This being the actual issue:
AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet#360

[shima20]

If I wanted to run the openiddict for jwt in production, is there a way to ensure that it doesn't get broken like this?

[capesean]

@shima20 you'd need to pin your versions in project.json. i.e. instead of using versions like 1-0-0-* you'd need to pin them to the exact versions that you have that work, like 1-0-0-rc2-21440.

[shima20]

@capesean good to know thanks! is there any way to tell which version is a good working version before this bug?

[capesean]

@shima20 you'll have to work that out for yourself, I'm afraid. I haven't been keeping track. It's a little tricky because you also have to pin the dependencies, i.e. the other packages that OpenIddict relies on also have to be pinned.

[kevinchalet]

FYI, the "missing signature" bug should be fixed soon by @brentschmaltz (who works for the MSFT Azure AD team, in charge of the JWT library OpenIddict relies on): AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet#364

[brentschmaltz]

@PinpointTownes Should be in today, sorry for the hassle.
thanks Pinpoint.

[shima20]

good to hear @brentschmaltz , looking forward to the fix!

[kevinchalet]

@brentschmaltz you're welcome! Thanks for the quick fix 👏

[shima20]

@brentschmaltz is there anything i need to do now? i tried again this morning and im still getting the same issue.

[kevinchalet]

@shima20 aspnet-contrib/AspNet.Security.OpenIdConnect.Server#232 (comment)

[shima20]

@PinpointTownes guess we are still waiting for it to be updated?

[kevinchalet]

The aspnet-contrib feed is now mirroring the Azure AD feed and ASOS was just updated to use the latest IdentityModel packages: aspnet-contrib/AspNet.Security.OpenIdConnect.Server@e3a8781.

The JWT issue you're seeing should disappear when updating your packages.

[shima20]

Thank you! It is in fact working again.