authorization - ASP.NET JSON Web Token "401 Unauthorized" -

i'm using decoupled resource , authentication servers. when json web token, check jwt.io , ok token format , it's secret.

request authorization header:

authorization: bearer token_here 

response "401 unauthorized":

{   "message": "authorization has been denied request." } 

here startup.cs resource server

using microsoft.owin; using microsoft.owin.cors; using microsoft.owin.security; using microsoft.owin.security.jwt; using newtonsoft.json.serialization; using owin; using system.web.http; using test.database; using test.infrastructure; using microsoft.windowsazure.serviceruntime;  [assembly: owinstartup(typeof(test.api.startup))] namespace custodesk.api {     public class startup     {         public void configuration(iappbuilder app)         {             app.createperowincontext(() =>                  applicationdbcontext.create(roleenvironment.getconfigurationsettingvalue("sqlconnectionstring")));             app.createperowincontext<applicationusermanager>(applicationusermanager.create);              globalconfiguration.configuration.suppressdefaulthostauthentication();              configureoauthtokenconsumption(app);              globalconfiguration.configure(config =>             {                 //global filters                 config.filters.add(new authorizeattribute());                  // web api routes                 config.maphttpattributeroutes();                 config.routes.maphttproute(                     name: "defaultapi",                     routetemplate: "{controller}/{action}/{id}",                     defaults: new { id = routeparameter.optional }                 );                  config.formatters.jsonformatter.serializersettings.contractresolver = new camelcasepropertynamescontractresolver();             });              app.usecors(corsoptions.allowall);              app.usewebapi(globalconfiguration.configuration);         }          private void configureoauthtokenconsumption(iappbuilder app)         {             var issuer = "http://localhost";             var audience = "universal_application";             var secret = helper.gethash("helper_class_to_get_the_same_hash_as_authentication_server");              // api controllers [authorize] attribute validated jwt             app.usejwtbearerauthentication(                 new jwtbearerauthenticationoptions                 {                     authenticationmode = authenticationmode.active,                     allowedaudiences = new[] { audience },                     issuersecuritytokenproviders = new iissuersecuritytokenprovider[]                     {                         new symmetrickeyissuersecuritytokenprovider(issuer, secret)                     }                 });          }     } } 

here example of token decrypted:

{   "typ": "jwt",   "alg": "hs256" } {   "nameid": "b22a825e-60ce-45ed-b2cb-b2ee46a47936",   "unique_name": "begunini",   "role": [     "owner",     "admin",     "managerviewer"   ],   "iss": "http://localhost",   "aud": "universal_application",   "exp": 1454876502,   "nbf": 1454876202 } 

i've checked secret , it's same on both sides (auth , resource servers). audience matches, issuer also. tried downgrade system.identitymodel.tokens.jwt version 3.0.2 no luck

i guess there problem in configuration order, nothing helped.

any ideas ?

tl;dr: have tried removing globalconfiguration.configuration.suppressdefaulthostauthentication()?

when using method, web api removes user principal created , added owin context host or middleware registered before web api (in case, jwt bearer middleware).

this method intended used hostauthenticationfilter or hostauthenticationattribute, directly invokes authentication middleware corresponding specified authentication type , persists resulting user principal in owin context.

since you're using suppressdefaulthostauthentication without hostauthenticationattribute, web api sees unauthenticated requests, , that's why rejected authorizeattribute.