Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

[Bug] HttpContext.GetTokenAsync("access_token") returns always null when using EnableTokenAcquisitionToCallDownstreamApi()

See original GitHub issue

Which version of Microsoft Identity Web are you using? Microsoft.Identity.Web 1.5.1

Where is the issue?

Web app
- Sign-in users
- Sign-in users and call web APIs
Web API
- Protected web APIs (validating tokens)
- Protected web APIs (validating scopes)
- Protected web APIs call downstream web APIs
Token cache serialization
- In-memory caches
- Session caches
- Distributed caches
Other (please describe)

Is this a new or an existing app? This is a new app

Repro

public void ConfigureServices(IServiceCollection services)
{
    // Adds Microsoft Identity platform (AAD v2.0) support to protect this API
    services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
                .AddMicrosoftIdentityWebApi(Configuration)
                .EnableTokenAcquisitionToCallDownstreamApi()
                .AddInMemoryTokenCaches();
    // ...
}

public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
{
    // ...

    app.Use(async (context, next) =>
    {
        var token = await context.GetTokenAsync("access_token");
        // token is always null here

        await next();
    });

    // ...
}

Expected behavior When JwtBearerOptions.SaveToken is true, context.GetTokenAsync("access_token") returns the access token used in the request.

Actual behavior context.GetTokenAsync("access_token") returns always null when EnableTokenAcquisitionToCallDownstreamApi() is used. When I remove EnableTokenAcquisitionToCallDownstreamApi(), I get the access token as expected.

Possible solution I debugged the code, and the problem is in MicrosoftIdentityWebApiAuthenticationBuilder.cs:

options.Events.OnTokenValidated = async context =>
{
    await onTokenValidatedHandler(context).ConfigureAwait(false);
    context.HttpContext.StoreTokenUsedToCallWebAPI(context.SecurityToken as JwtSecurityToken);
    context.Success();
};

I don’t know why context.Success(); it’s needed, but when I remove it, everything works as expected.