> ## Documentation Index
> Fetch the complete documentation index at: https://docs-staging-quickstart-revamp.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.
> This tutorial demonstrates how to add authorization to an ASP.NET OWIN API using the standard JWT middleware.
# Add Authorization to Your ASP.NET OWIN Web API Application
export const LoggedInForm = ({sampleApp}) => {
const LS_APPS_KEY = "auth_demo_apps";
const LS_APP_CFG_KEY = "auth_demo_app_cfg";
const CHANNEL = "auth_flows_sync_v1";
const mkChannel = () => new BroadcastChannel(CHANNEL);
function uid() {
return Math.random().toString(36).slice(2) + Date.now().toString(36);
}
function loadApps() {
const raw = localStorage.getItem(LS_APPS_KEY);
if (raw) return JSON.parse(raw);
const seeded = [{
id: "mz9iNEIo2PHu7oeh8QRt19ndTyyCIgai",
name: "Default App"
}];
localStorage.setItem(LS_APPS_KEY, JSON.stringify(seeded));
return seeded;
}
function saveApps(apps) {
localStorage.setItem(LS_APPS_KEY, JSON.stringify(apps));
}
function loadCfg() {
const raw = localStorage.getItem(LS_APP_CFG_KEY);
return raw ? JSON.parse(raw) : {};
}
function saveCfg(cfg) {
localStorage.setItem(LS_APP_CFG_KEY, JSON.stringify(cfg));
}
const RightChevron = ({className = "w-5 h-5", ...props}) => ;
const LightningIcon = () => ;
const LayersIcon = () => ;
const GithubIcon = () => ;
function IconTile({children}) {
return
{children}
;
}
function Card({className = "", children}) {
return
{children}
;
}
function Button({variant = "primary", type = "button", onClick, children}) {
const base = "inline-flex items-center justify-center gap-2 h-10 px-4 rounded-xl font-medium transition";
let styles = "";
if (variant === "primary") {
styles = "mint-bg-indigo-600 text-white hover:mint-bg-indigo-700";
} else if (variant === "outline") {
styles = "border border-zinc-300 dark:border-zinc-700 mint-bg-transparent hover:mint-bg-zinc-50 dark:hover:mint-bg-zinc-800";
} else if (variant === "ghost") {
styles = "hover:mint-bg-zinc-100 dark:hover:mint-bg-zinc-800";
}
return ;
}
function Input({id, label, value, onChange, placeholder, name}) {
return ;
}
function Select({label, value, onChange, options}) {
return ;
}
function Toast({open, onClose, children}) {
useEffect(() => {
if (!open) return;
const t = setTimeout(onClose, 2200);
return () => clearTimeout(t);
}, [open, onClose]);
return
Sign up for an{" "}
Auth0 account
{" "}
or{" "}
console.log("log in")}>
log in
{" "}
to your existing account to integrate directly with your own tenant.
;
};
export const sections = [{
id: "define-permissions",
title: "Define permissions"
}, {
id: "install-dependencies",
title: "Install dependencies"
}, {
id: "configure-the-middleware",
title: "Configure the middleware"
}, {
id: "verify-the-token-signature",
title: "Verify the token signature"
}, {
id: "validate-scopes",
title: "Validate scopes"
}, {
id: "protect-api-endpoints",
title: "Protect API endpoints"
}];
Auth0 allows you to add authorization to any kind of application. This guide demonstrates how to integrate Auth0
with any new or existing ASP.NET Owin Web API application using the `Microsoft.Owin.Security.Jwt`
package.
If you have not created an API in your Auth0 dashboard yet, you can use the interactive selector to create a new
Auth0 API or select an existing API for your project.
To set up your first API through the Auth0 dashboard, review our getting started guide.
Each Auth0 API uses the API Identifier, which your application needs to validate the access token.
**New to Auth0?** Learn how Auth0 works and
read about implementing API authentication and
authorization using the OAuth 2.0 framework.
Permissions let you define how resources can be accessed on behalf of the user with a given access token. For
example, you might choose to grant read access to the `messages` resource if users have the manager
access level, and a write access to that resource if they have the administrator access level.
You can define allowed permissions in the **Permissions** view of the Auth0 Dashboard's [APIs](https://manage.auth0.com/#/apis) section. The following
example uses the `read:messages` scope.
Install the `Microsoft.Owin.Security.Jwt` NuGetPackage. This package contains the OWIN JWT Middleware
necessary to use Auth0 access tokens in the ASP.NET Owin Web API.
```ps lines
Install-Package Microsoft.Owin.Security.Jwt
```
Go to the `Configuration` method of your `Startup` class and add a call to
`UseJwtBearerAuthentication` passing in the configured `JwtBearerAuthenticationOptions`.
The `JwtBearerAuthenticationOptions` needs to specify your Auth0 API Identifier in the
`ValidAudience` property, and the full path to your Auth0 domain as the `ValidIssuer`. You
will need to configure the `IssuerSigningKeyResolver` to use the instance of
`OpenIdConnectSigningKeyResolver` to resolve the signing key.
**Do not forget the trailing slash.**
Ensure the URL specified for `ValidIssuer` contains a trailing forward slash
(`/`). This must match exactly with the JWT issuer claim. API calls will not authenticate
correctly if you misconfigured this value.
The OWIN JWT middleware does not use Open ID Connect Discovery by default, so you must provide a custom
`IssuerSigningKeyResolver`.
Create the `OpenIdConnectSigningKeyResolver` class and ensure to return the correct
`SecurityKey` by implementing `GetSigningKey`. This class is then used as
`TokenValidationParameters.IssuerSigningKeyResolver` while configuring the middleware in
`Startup.cs`.
This custom resolver is deprecated and [no longer available](https://github.com/auth0/auth0-aspnet-owin/blob/master/SECURITY-NOTICE.md). You must provide this custom resolver yourself.
The JWT middleware verifies that the access token included in the request is valid; however, it doesn't yet
include any mechanism for checking that the token has the sufficient **scope** to access the requested
resources.
Create a class called `ScopeAuthorizeAttribute` which inherits from
`System.Web.Http.AuthorizeAttribute`. This attribute will check that the `scope` claim
issued by your Auth0 tenant is present, and if so, it will ensure that the `scope` claim contains the
requested scope.
The routes shown below are available for the following requests:
* `GET /api/public`: Available for non-authenticated requests.
* `GET /api/private`: Available for authenticated requests containing an access token with no
additional scopes.
* `GET /api/private-scoped`: Available for authenticated requests containing an access token with
the `read:messages`scope granted.
The JWT middleware integrates with the standard ASP.NET authentication and authorization mechanisms, so you only
need to decorate your controller action with the `[Authorize]` attribute to secure an endpoint.
Update the action with the `ScopeAuthorize` attribute and pass the name of the required
`scope` in the `scope` parameter. This ensures the correct scope is available to call a
specific API endpoint.
##### Checkpoint
Now that you have configured your application, run your application and verify that:
* `GET /api/public`is available for non-authenticated requests.
* `GET /api/private`is available for authenticated requests.
* `GET /api/private-scoped`is available for authenticated requests containing an access
token with the `read:messages`scope.
## Next Steps
Excellent work! If you made it this far, you should now have login, logout, and user profile information running in your application.
This concludes our quickstart tutorial, but there is so much more to explore. To learn more about what you can do with Auth0, check out:
* [Auth0 Dashboard](https://manage.auth0.com/dashboard/us/dev-gja8kxz4ndtex3rq) - Learn how to configure and manage your Auth0 tenant and applications
* [Auth0 Marketplace](https://marketplace.auth0.com/) - Discover integrations you can enable to extend Auth0’s functionality
```cs OpenIdConnectSigningKeyResolver.cs lines highlight={}
public class OpenIdConnectSigningKeyResolver
{
private readonly OpenIdConnectConfiguration openIdConfig;
public OpenIdConnectSigningKeyResolver(string authority)
{
var cm = new ConfigurationManager($"{authority.TrimEnd('/')}/.well-known/openid-configuration", new OpenIdConnectConfigurationRetriever());
openIdConfig = AsyncHelper.RunSync(async () => await cm.GetConfigurationAsync());
}
public SecurityKey[] GetSigningKey(string kid)
{
return new[] { openIdConfig.JsonWebKeySet.GetSigningKeys().FirstOrDefault(t => t.KeyId == kid) };
}
}
```
```cs ScopeAuthorizeAttribute.cs lines highlight={}
public class ScopeAuthorizeAttribute : AuthorizeAttribute
{
private readonly string scope;
public ScopeAuthorizeAttribute(string scope)
{
this.scope = scope;
}
public override void OnAuthorization(HttpActionContext actionContext)
{
base.OnAuthorization(actionContext);
// Get the Auth0 domain, in order to validate the issuer
var domain = $"https://{ConfigurationManager.AppSettings["Auth0Domain"]}/";
// Get the claim principal
ClaimsPrincipal principal = actionContext.ControllerContext.RequestContext.Principal as ClaimsPrincipal;
// Get the scope clain. Ensure that the issuer is for the correcr Auth0 domain
var scopeClaim = principal?.Claims.FirstOrDefault(c => c.Type == "scope" && c.Issuer == domain);
if (scopeClaim != null)
{
// Split scopes
var scopes = scopeClaim.Value.Split(' ');
// Succeed if the scope array contains the required scope
if (scopes.Any(s => s == scope))
return;
}
HandleUnauthorizedRequest(actionContext);
}
}
```
```cs ApiController.cs lines highlight={}
[RoutePrefix("api")]
public class ApiController : ApiController
{
[HttpGet]
[Route("public")]
public IHttpActionResult Public()
{
return Json(new
{
Message = "Hello from a public endpoint!"
});
}
[HttpGet]
[Route("private")]
[Authorize]
public IHttpActionResult Private()
{
return Json(new
{
Message = "Hello from a private endpoint! You need to be authenticated to see this."
});
}
[HttpGet]
[Route("private-scoped")]
[ScopeAuthorize("read:messages")]
public IHttpActionResult Scoped()
{
return Json(new
{
Message = "Hello from a private endpoint! You need to be authenticated and have a scope of read:messages to see this."
});
}
}
```
```cs OpenIdConnectSigningKeyResolver.cs lines highlight={}
public class OpenIdConnectSigningKeyResolver
{
private readonly OpenIdConnectConfiguration openIdConfig;
public OpenIdConnectSigningKeyResolver(string authority)
{
var cm = new ConfigurationManager($"{authority.TrimEnd('/')}/.well-known/openid-configuration", new OpenIdConnectConfigurationRetriever());
openIdConfig = AsyncHelper.RunSync(async () => await cm.GetConfigurationAsync());
}
public SecurityKey[] GetSigningKey(string kid)
{
return new[] { openIdConfig.JsonWebKeySet.GetSigningKeys().FirstOrDefault(t => t.KeyId == kid) };
}
}
```
```cs ScopeAuthorizeAttribute.cs lines highlight={}
public class ScopeAuthorizeAttribute : AuthorizeAttribute
{
private readonly string scope;
public ScopeAuthorizeAttribute(string scope)
{
this.scope = scope;
}
public override void OnAuthorization(HttpActionContext actionContext)
{
base.OnAuthorization(actionContext);
// Get the Auth0 domain, in order to validate the issuer
var domain = $"https://{ConfigurationManager.AppSettings["Auth0Domain"]}/";
// Get the claim principal
ClaimsPrincipal principal = actionContext.ControllerContext.RequestContext.Principal as ClaimsPrincipal;
// Get the scope clain. Ensure that the issuer is for the correcr Auth0 domain
var scopeClaim = principal?.Claims.FirstOrDefault(c => c.Type == "scope" && c.Issuer == domain);
if (scopeClaim != null)
{
// Split scopes
var scopes = scopeClaim.Value.Split(' ');
// Succeed if the scope array contains the required scope
if (scopes.Any(s => s == scope))
return;
}
HandleUnauthorizedRequest(actionContext);
}
}
```
```cs ApiController.cs lines highlight={}
[RoutePrefix("api")]
public class ApiController : ApiController
{
[HttpGet]
[Route("public")]
public IHttpActionResult Public()
{
return Json(new
{
Message = "Hello from a public endpoint!"
});
}
[HttpGet]
[Route("private")]
[Authorize]
public IHttpActionResult Private()
{
return Json(new
{
Message = "Hello from a private endpoint! You need to be authenticated to see this."
});
}
[HttpGet]
[Route("private-scoped")]
[ScopeAuthorize("read:messages")]
public IHttpActionResult Scoped()
{
return Json(new
{
Message = "Hello from a private endpoint! You need to be authenticated and have a scope of read:messages to see this."
});
}
}
```
```cs ScopeAuthorizeAttribute.cs lines highlight={}
public class ScopeAuthorizeAttribute : AuthorizeAttribute
{
private readonly string scope;
public ScopeAuthorizeAttribute(string scope)
{
this.scope = scope;
}
public override void OnAuthorization(HttpActionContext actionContext)
{
base.OnAuthorization(actionContext);
// Get the Auth0 domain, in order to validate the issuer
var domain = $"https://{ConfigurationManager.AppSettings["Auth0Domain"]}/";
// Get the claim principal
ClaimsPrincipal principal = actionContext.ControllerContext.RequestContext.Principal as ClaimsPrincipal;
// Get the scope clain. Ensure that the issuer is for the correcr Auth0 domain
var scopeClaim = principal?.Claims.FirstOrDefault(c => c.Type == "scope" && c.Issuer == domain);
if (scopeClaim != null)
{
// Split scopes
var scopes = scopeClaim.Value.Split(' ');
// Succeed if the scope array contains the required scope
if (scopes.Any(s => s == scope))
return;
}
HandleUnauthorizedRequest(actionContext);
}
}
```
```cs OpenIdConnectSigningKeyResolver.cs lines highlight={}
public class OpenIdConnectSigningKeyResolver
{
private readonly OpenIdConnectConfiguration openIdConfig;
public OpenIdConnectSigningKeyResolver(string authority)
{
var cm = new ConfigurationManager($"{authority.TrimEnd('/')}/.well-known/openid-configuration", new OpenIdConnectConfigurationRetriever());
openIdConfig = AsyncHelper.RunSync(async () => await cm.GetConfigurationAsync());
}
public SecurityKey[] GetSigningKey(string kid)
{
return new[] { openIdConfig.JsonWebKeySet.GetSigningKeys().FirstOrDefault(t => t.KeyId == kid) };
}
}
```
```cs ApiController.cs lines highlight={}
[RoutePrefix("api")]
public class ApiController : ApiController
{
[HttpGet]
[Route("public")]
public IHttpActionResult Public()
{
return Json(new
{
Message = "Hello from a public endpoint!"
});
}
[HttpGet]
[Route("private")]
[Authorize]
public IHttpActionResult Private()
{
return Json(new
{
Message = "Hello from a private endpoint! You need to be authenticated to see this."
});
}
[HttpGet]
[Route("private-scoped")]
[ScopeAuthorize("read:messages")]
public IHttpActionResult Scoped()
{
return Json(new
{
Message = "Hello from a private endpoint! You need to be authenticated and have a scope of read:messages to see this."
});
}
}
```
```cs ApiController.cs lines highlight={}
[RoutePrefix("api")]
public class ApiController : ApiController
{
[HttpGet]
[Route("public")]
public IHttpActionResult Public()
{
return Json(new
{
Message = "Hello from a public endpoint!"
});
}
[HttpGet]
[Route("private")]
[Authorize]
public IHttpActionResult Private()
{
return Json(new
{
Message = "Hello from a private endpoint! You need to be authenticated to see this."
});
}
[HttpGet]
[Route("private-scoped")]
[ScopeAuthorize("read:messages")]
public IHttpActionResult Scoped()
{
return Json(new
{
Message = "Hello from a private endpoint! You need to be authenticated and have a scope of read:messages to see this."
});
}
}
```
```cs OpenIdConnectSigningKeyResolver.cs lines highlight={}
public class OpenIdConnectSigningKeyResolver
{
private readonly OpenIdConnectConfiguration openIdConfig;
public OpenIdConnectSigningKeyResolver(string authority)
{
var cm = new ConfigurationManager($"{authority.TrimEnd('/')}/.well-known/openid-configuration", new OpenIdConnectConfigurationRetriever());
openIdConfig = AsyncHelper.RunSync(async () => await cm.GetConfigurationAsync());
}
public SecurityKey[] GetSigningKey(string kid)
{
return new[] { openIdConfig.JsonWebKeySet.GetSigningKeys().FirstOrDefault(t => t.KeyId == kid) };
}
}
```
```cs ScopeAuthorizeAttribute.cs lines highlight={}
public class ScopeAuthorizeAttribute : AuthorizeAttribute
{
private readonly string scope;
public ScopeAuthorizeAttribute(string scope)
{
this.scope = scope;
}
public override void OnAuthorization(HttpActionContext actionContext)
{
base.OnAuthorization(actionContext);
// Get the Auth0 domain, in order to validate the issuer
var domain = $"https://{ConfigurationManager.AppSettings["Auth0Domain"]}/";
// Get the claim principal
ClaimsPrincipal principal = actionContext.ControllerContext.RequestContext.Principal as ClaimsPrincipal;
// Get the scope clain. Ensure that the issuer is for the correcr Auth0 domain
var scopeClaim = principal?.Claims.FirstOrDefault(c => c.Type == "scope" && c.Issuer == domain);
if (scopeClaim != null)
{
// Split scopes
var scopes = scopeClaim.Value.Split(' ');
// Succeed if the scope array contains the required scope
if (scopes.Any(s => s == scope))
return;
}
HandleUnauthorizedRequest(actionContext);
}
}
```
Sign up for an{" "}
Auth0 account
{" "}
or{" "}
console.log("log in")}>
log in
{" "}
to your existing account to integrate directly with your own tenant.
