Web API 2 OWIN Bearer token authentication - AccessTokenFormat null?

Question

I have an existing ASP.NET MVC 5 project and I'm adding a Web API 2 project to it. I want to use bearer token authentication and have followed Hongye Sun's tutorial "OWIN Bearer Token Authentication with Web API Sample" and this question as well. In my `Login` method, for the line `Startup.OAuthBearerOptions.AccessTokenFormat.Protect(ticket);`, the AccessTokenFormat is null. Any idea why? My AccountController: ``` [RoutePrefix("api")] public class AccountController : ApiController { public AccountController() {} // POST api/login [HttpPost] [Route("login")] public HttpResponseMessage Login(int id, string pwd) { if (id > 0) // testing - not authenticating right now { var identity = new ClaimsIdentity(Startup.OAuthBearerOptions.AuthenticationType); identity.AddClaim(new Claim(ClaimTypes.Name, id.ToString())); AuthenticationTicket ticket = new AuthenticationTicket(identity, new AuthenticationProperties()); var currentUtc = new SystemClock().UtcNow; ticket.Properties.IssuedUtc = currentUt…

Accepted Answer

I had the same problem - it was to do with my initialisation in Startup().

Like you, I was storing the OAuthBearerOptions in a static field:

```
OAuthBearerOptions = new OAuthBearerAuthenticationOptions();
```

But then I was wrongly using a new instance of the same class later on:

```
app.UseOAuthBearerAuthentication(new OAuthBearerAuthenticationOptions());  // wrong!
```

Obviously the fix was to use the static field instead:

```
app.UseOAuthBearerAuthentication(OAuthBearerOptions);
```

In fact, it doesn't look like you call UseOAuthBearerAuthentication() at all. I followed this excellent series of posts by Taiseer Joudeh.

Full Startup.cs:

```
public class Startup
{
    public static OAuthBearerAuthenticationOptions OAuthBearerOptions { get; private set; }

public void Configuration(IAppBuilder app)
    {
        HttpConfiguration config = new HttpConfiguration();

ConfigureOAuth(app);

WebApiConfig.Register(config);
        app.UseCors(Microsoft.Owin.Cors.CorsOptions.AllowAll);
        app.UseWebApi(config);
    }

public void ConfigureOAuth(IAppBuilder app)
    {
        //use a cookie to temporarily store information about a user logging in with a third party login provider
        app.UseExternalSignInCookie(Microsoft.AspNet.Identity.DefaultAuthenticationTypes.ExternalCookie);
        OAuthBearerOptions = new OAuthBearerAuthenticationOptions();

OAuthAuthorizationServerOptions OAuthServerOptions = new OAuthAuthorizationServerOptions() {

AllowInsecureHttp = true,
            TokenEndpointPath = new PathString("/token"),
            AccessTokenExpireTimeSpan = TimeSpan.FromDays(1),
            Provider = new SimpleAuthorizationServerProvider()  // see post
        };

// Token Generation
        app.UseOAuthAuthorizationServer(OAuthServerOptions);
        app.UseOAuthBearerAuthentication(OAuthBearerOptions);

//[Configure External Logins...]
    }
}
```

Web API 2 OWIN Bearer token authentication - AccessTokenFormat null?

Solution

Problem

Related problems