OpenIddict with EnableDegradedMode on the server and UseIntrospection for multiple API projects - openiddict

Question

.NET 5 / OpenIddict 3.0
I would like to keep authentications centralized on a project called AuthProject.
If I have multiple API projects called API1, API2, API3, API4, how do I authenticate them with the token received by AuthProject?
My AuthProject has the following settings:
services.AddOpenIddict()
.AddServer(options =>
{
options
.SetTokenEndpointUris("/connect/token")
.SetAuthorizationEndpointUris("/connect/authorize")
.SetIntrospectionEndpointUris("/connect/introspect");
options.RegisterScopes(Scopes.Email, Scopes.Profile, Scopes.Roles);
options.AllowPasswordFlow()
.AllowRefreshTokenFlow()
.AllowClientCredentialsFlow()
.AllowImplicitFlow();
options.AddDevelopmentEncryptionCertificate();
options.AddDevelopmentSigningCertificate();
options.UseAspNetCore();
options.EnableDegradedMode();
options.AddEventHandler<ValidateAuthorizationRequestContext>(builder => builder.UseScopedHandler<MyValidateAuthorizationRequestContext>());
options.AddEventHandler<ValidateTokenRequestContext>(builder => builder.UseScopedHandler<MyValidateTokenRequestContext>());
options.AddEventHandler<HandleAuthorizationRequestContext>(builder => builder.UseScopedHandler<MyHandleAuthorizationRequestContext>());
options.AddEventHandler<HandleTokenRequestContext>(builder => builder.UseScopedHandler<MyHandleTokenRequestContext>());
options.AddEventHandler<ValidateIntrospectionRequestContext>(builder => builder.UseScopedHandler<MyValidateIntrospectionRequestContext>());
options.AddEventHandler<HandleIntrospectionRequestContext>(builder => builder.UseScopedHandler<MyHandleIntrospectionRequestContext>());
})
.AddValidation(options =>
{
options.UseLocalServer();
options.UseAspNetCore();
});
I normally connect to connect/token, I receive the token, I can connect normally to the APIs that are in the AuthProject.
All APIs are decorated by [Authorized]
Everything works.
When I try to access any API decorated by [Authorize] being in API1, API2, API3, API4 (other API projects), I always receive Status 401 - Unauthorized.
The configurations of these API projects are:
services.AddAuthentication(options =>
{
options.DefaultScheme = OpenIddictValidationAspNetCoreDefaults.AuthenticationScheme;
});
services.AddOpenIddict()
.AddValidation(options =>
{
options.SetIssuer("https://authProjectUrl/");
options.AddAudiences("api1");
options.UseIntrospection()
.SetClientId("api1")
.SetClientSecret("xxxxxxxxxx");
options.UseSystemNetHttp();
options.UseAspNetCore();
});
In AuthProject project, the implementations for ValidateIntrospectionRequestContext are:
public class MyValidateIntrospectionRequestContext : IOpenIddictServerHandler<ValidateIntrospectionRequestContext>
{
public ValueTask HandleAsync(ValidateIntrospectionRequestContext context)
{
if (context.ClientId != "api1" || context.ClientSecret != "xxxx")
context.Reject("Error");
return default;
}
}
In AuthProject, the implementations for HandleIntrospectionRequestContext are:
public class MyHandleIntrospectionRequestContext : IOpenIddictServerHandler<HandleIntrospectionRequestContext>
{
public ValueTask HandleAsync(HandleIntrospectionRequestContext context)
{
return default;
}
}
What is missing? What's wrong?
What should I do to API1, API2, API3, API4 projects understand that if I pass the token to them, they must also understand that they are authorized?
Detail:
I call the APIs by correctly passing the token through Bearer, and the APIs automatically correctly call the MyValidateIntrospectionRequestContext and MyHandleIntrospectionRequestContext handlers.
Debugging, everything works without errors.
But the return by POSTMAN is always code 401.

Answer 1

It worked.
I needed to add the following code in MyHandleIntrospectionRequestContext:
context.Audiences.Add("api1");
context.Audiences.Add("api2");
context.Audiences.Add("api3");