title: Securing and accessing a .NET core WebApi service using OAuth2
body: <p>I have a working Asp.NET core WebApi service and a that can be called from an ASP.NET core MVC application. The service is called using an AutoRest generated wrapper. The service currently has no security layer while the website is secured using OAuth2.</p>
  
  <p>I have added the following to the service:</p>
  
  <pre><code>public void ConfigureServices(IServiceCollection services)
      {
          // Add framework services.
          services.AddApplicationInsightsTelemetry(Configuration);
  
          services.AddMvc();
  
          // NEW Authorisation
          services.AddAuthorization(options =&gt;
          {
              options.AddPolicy("ApiAccess", policy =&gt; policy.RequireClaim("email"));
          });
  
      }
  </code></pre>
  
  <p>My Controller is secured so:</p>
  
  <pre><code>[Authorize(Policy = "ApiAccess")]
  public class StatusController : Controller
  </code></pre>
  
  <p>However I get an "Unauthorized" exception when I call the AutoRest wrapper:</p>
  
  <pre><code>try
          {
              var service = new StatusAPI(new Uri("http://localhost:17237/"));
              ViewData["State"] = service.ApiStatusGet();
          }
          catch (Exception ex)
          {
              ViewData["State"] = new[] { new ServiceStatus { Name = "Health API", Message = "Is unreachable " + ex.Message } };
          }
  </code></pre>
  
  <p>I'm not sure if the problem lies in that I need a way to pass on the claims in my call to the wrapper or if its in my setup of the service and how it detects the claims.</p>