title: Using IdentityServer3 to secure a Nancy API with JS access
body: <p>I'm currently redeveloping a site, which will consist of three projects - an API(using Nancy), a web client and an identity system(using IdentityServer3) with the aim to keep all 3 as decoupled as possible.</p>
  
  <p>I'm totally new to IdentityServer3, and my knowledge of token-based authentication is middling at best.</p>
  
  <p>Now I've got the logging in aspect down, with an access token holding a number of claims:</p>
  
  <pre><code>public Task AuthenticateLocalAsync(LocalAuthenticationContext context)
      {
          using (var principalContext = new PrincipalContext(ContextType.Domain, Domain, Username, Password))
          {
              if (!principalContext.ValidateCredentials(context.UserName, context.Password))
              {
                  return Task.FromResult(0);
              }
  
              using (var userPrincipal = UserPrincipal.FindByIdentity(principalContext, IdentityType.SamAccountName, context.UserName))
              {
                  if (userPrincipal == null)
                  {
                      return Task.FromResult(0);
                  }
  
                  var user = new AuthenticateResult(userPrincipal.Sid.ToString(), context.UserName, _claimsRepository.List(userPrincipal.Sid.ToString()));
  
                  context.AuthenticateResult = user;
              }
          }
  
          return Task.FromResult(0);
      }
  </code></pre>
  
  <p>And using a modified example of the IdentityServer3 example JS code I call the API:</p>
  
  <pre><code>client.processSigninResponse().then(function (response) {
      $.ajax({
          type: 'GET',
          url: 'http://localhost:56568/api/v1/test',
          beforeSend: function (xhr) {
              console.log(response);
              xhr.setRequestHeader('Authorization', 'Bearer ' + response.access_token);
          }
      }).then(function () {
          console.log('success');
          console.log(arguments);
      }, function () {
          console.log('failed');
          console.log(arguments);
  
      });
  }).catch(function (err) {
      log(err);
  });
  </code></pre>
  
  <p>However, when I catch this with Nancy:</p>
  
  <pre><code>public TestModule() : base("api/v1/test")
      {
          Get["/"] = parameters =&gt;
          {
              var user = Context.GetMSOwinUser();
              return HttpStatusCode.OK;
          };
      }
  </code></pre>
  
  <p>The user isn't authenticated, and there are no claims. The token is being sent over though.</p>
  
  <p>I'm referencing Microsoft.Owin, Microsoft.Owin.Host.SystemWeb, Microsoft,Owin.Security, Microsoft.Owin.Security.OAuth, Nancy.Owin and Nancy.MSOwinSecurity and my startup class looks like:</p>
  
  <pre><code>public class Startup
  {
      public void Configuration(IAppBuilder app)
      {
          app.UseOAuthBearerAuthentication(new OAuthBearerAuthenticationOptions());
          app.UseNancy();
          app.UseStageMarker(PipelineStage.MapHandler);
      }
  }
  </code></pre>
  
  <p>I'm assuming I've missed something pretty fundamental out, so any pointers towards anything boneheaded I'm doing/not doing would be appreciated!</p>