angular 15 + azure b2c

i’m using the above techs to port as a poc an old app. login to b2c is done in angular, using code flow, and it returns a complete set of data ( access token, custom roles etc).

i’m now trying to protect an endpoint by using eg:

public override void Configure()
        {
            Claims("sub");
            Post("/users/getuserbyid");
            //Policies("LoggedIn");
        }

or by setting up a policy in program.cs:

builder.Services.AddAuthorization(options =>
{
    options.AddPolicy("LoggedIn", x => x.RequireClaim("sub"));
});

  builder.Services.AddAuthentication(o =>
  {
      o.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
      o.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
  })
  .AddJwtBearer(o =>
  {
      o.Authority = $"https://xxxxx.b2clogin.com/xxxxx.onmicrosoft.com/B2C_1_signin/v2.0";
      o.Audience = "xxxx-xxxx-xxxx-xxxx";
  });

the call from angular looks like:

    const options = { headers: new HttpHeaders({
                    Authorization: 'Bearer ' + this.accessToken,
                    Accept: 'application/json, text/plain, */*'
                  }), 
                  params: new HttpParams().set("Id", id)};

    return this.http.post<T>(this.apiBaseUrl + url, options);
  }

and my request object server-side looks like:

public class EntityByIdRequest
    {
        [From(Claim.name, IsRequired = true)] 
        public string name { get; set; }

        public string Id { get; set; } = string.Empty;
    }

nothing works. i am never authenticated and i never get the id i pass in the params object in the request, unless i remove the authorization restriction. i’m obv. missing something, but what? any ideas anyone?

[aylmercarson]

…sorted. although the api was declaring my jwt as valid, including validating the audience, i had an incorrect audience setting. i did a few other minor changes but afaict that was the main issue. thanks again for your help.

[dj-nitehawk]

if all else fails, do a minimalistic repro using asp.net minimal apis according to their tutorials/guides and i’ll help to convert that to fastendpoints.