IdentityServer4 -How can I add clientId and clientSecret to services?-CodePudding

I have IdentityServer project and API. I get JWT Token from IdentityServer to send requests to my API.

In my API, I don't use clientId and clientSecret anywhere. I don't understand why???

When I researched, API's Program.cs is used like this by many people;

builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme).AddJwtBearer(options =>
{
   options.Authority = "[identity server url]";
   options.Audience = "[api resourse name]";
   options.RequireHttpsMetadata = false;
});

what I don't understand is, there is no clientId and clientSecret here.

Some people use [IdentityServer4.AccessTokenValidation] to do what I wanted by using this;

services.AddAuthentication(IdentityServerAuthenticationDefaults.AuthenticationScheme)
.AddIdentityServerAuthentication(options =>
{
    options.Authority = "https://demo.identityserver.io";
    options.ApiName = "api1";
    options.ApiSecret = "secret";
});

But when I tried this, my api doesn't return 401 Unauthorized and returns 200 OK even though my clientSecret is not correct.

How can I solve this problem ?

CodePudding user response：

The AddJwtBearer authentication handler that you use in the API doesn't need a clientid/secret because all it needs to do is to accept and validate incoming access tokens using the public key that it downloads from the IdentityServer discovery document.

I think the IdentityServer4.AccessTokenValidation is mainly useful if you need to support both JWT and reference tokens. But usually you only need JWT tokens.