Pass through authentication with ASP Core MVC, Web API and IdentityServer4? : <p>I have been working on migrating a monolithic ASP Core MVC application to use an service architecture design.  The MVC front-end website uses an <code>HttpClient</code> to load necessary data from the ASP Core Web API.  A small portion of the front-end MVC app also requires authentication which is in place using IdentityServer4 (integrated with the back-end API).  This all works great, until I put an <code>Authorize</code> attribute on a controller or method on the Web API.  I know I need to somehow pass the user authorization from the front-end to the back-end in order for this to work, but I'm not sure how.  I have tried getting the access_token: <code>User.FindFirst("access_token")</code> but it returns null.  I then tried this method and I am able to get the token:</p>

<pre><code>var client = new HttpClient("url.com");
var token = HttpContext.Authentication.GetTokenAsync("access_token")?.Result;
client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", token);
</code></pre>

<p>This method gets the token but still doesn't authentication with the back-end API.  I'm pretty new to this OpenId/IdentityServer concepts and any help would be appreciated!</p>

<p>Here is the relevant code from the MVC Client Startup class:</p>

<pre><code>    private void ConfigureAuthentication(IApplicationBuilder app)
    {
        app.UseCookieAuthentication(new CookieAuthenticationOptions
        {
            AuthenticationScheme = "Cookies",
            AutomaticAuthenticate = true,
            ExpireTimeSpan = TimeSpan.FromMinutes(60)
        });
        JwtSecurityTokenHandler.DefaultInboundClaimTypeMap.Clear();
        app.UseOpenIdConnectAuthentication(new OpenIdConnectOptions
        {
            AuthenticationScheme = "oidc",
            SignInScheme = "Cookies",

            Authority = "https://localhost:44348/",
            RequireHttpsMetadata = false,

            ClientId = "clientid",
            ClientSecret = "secret",

            ResponseType = "code id_token",
            Scope = { "openid", "profile" },
            GetClaimsFromUserInfoEndpoint = true,
            AutomaticChallenge = true, // Required to 302 redirect to login
            SaveTokens = true,

            TokenValidationParameters = new Microsoft.IdentityModel.Tokens.TokenValidationParameters
            {
                NameClaimType = "Name",
                RoleClaimType = "Role",
                SaveSigninToken = true
            },


        });
    }
</code></pre>

<p>and the StartUp class of the API:</p>

<pre><code>        // Add authentication
        services.AddIdentity&lt;ExtranetUser, IdentityRole&gt;(options =&gt;
        {
            // Password settings
            options.Password.RequireDigit = true;
            options.Password.RequiredLength = 8;
            options.Password.RequireNonAlphanumeric = true;
            options.Password.RequireUppercase = true;
            options.Password.RequireLowercase = true;

            // Lockout settings
            options.Lockout.DefaultLockoutTimeSpan = TimeSpan.FromMinutes(30);
            options.Lockout.MaxFailedAccessAttempts = 10;

            // User settings
            options.User.RequireUniqueEmail = true;
        })
            .AddDefaultTokenProviders();
        services.AddScoped&lt;IUserStore&lt;ExtranetUser&gt;, ExtranetUserStore&gt;();
        services.AddScoped&lt;IRoleStore&lt;IdentityRole&gt;, ExtranetRoleStore&gt;();
        services.AddSingleton&lt;IAuthorizationHandler, AllRolesRequirement.Handler&gt;();
        services.AddSingleton&lt;IAuthorizationHandler, OneRoleRequirement.Handler&gt;();
        services.AddSingleton&lt;IAuthorizationHandler, EditQuestionAuthorizationHandler&gt;();
        services.AddSingleton&lt;IAuthorizationHandler, EditExamAuthorizationHandler&gt;();
        services.AddAuthorization(options =&gt;
        {
            /* ... etc .... */
        });
        var serviceProvider = services.BuildServiceProvider();
        var serviceSettings = serviceProvider.GetService&lt;IOptions&lt;ServiceSettings&gt;&gt;().Value;
        services.AddIdentityServer() // Configures OAuth/IdentityServer framework
            .AddInMemoryIdentityResources(IdentityServerConfig.GetIdentityResources())
            .AddInMemoryClients(IdentityServerConfig.GetClients(serviceSettings))
            .AddAspNetIdentity&lt;ExtranetUser&gt;()
            .AddTemporarySigningCredential(); // ToDo: Add permanent SigningCredential for IdentityServer
</code></pre>
