title: Authorize Attribute Authentication with Postman in Web Api
body: <p>I am working with RESTful services and find Postman as one of the best plugin to GET, POST and test the API's.</p>
  
  <p>I find Basic Auth, No Auth, DIgest Auth, OAuth, AWS in postman. How do I test the Authorize Controller and methods. </p>
  
  <p>I am aware that Authorize attribute checks <code>user.Identity.IsAuthenticated</code></p>
  
  <p>I am not sure on how to pass authorize in controller and methods with specific roles like below using Postman</p>
  
  <pre><code>[Authorize(Roles = "Admin, Super User")]
  
  public ActionResult AdministratorsOnly()
  {
      return View();
  }
  </code></pre>
  
  <p>Here is my Startup file </p>
  
  <pre><code>  public static OAuthAuthorizationServerOptions OAuthOptions { get; private set; }
  
      public static string PublicClientId { get; private set; }
  
      // For more information on configuring authentication, please visit http://go.microsoft.com/fwlink/?LinkId=301864
      public void ConfigureAuth(IAppBuilder app)
      {
          // Configure the db context and user manager to use a single instance per request
          app.CreatePerOwinContext(ApplicationDbContext.Create);
          app.CreatePerOwinContext&lt;ApplicationUserManager&gt;(ApplicationUserManager.Create);
  
          // Enable the application to use a cookie to store information for the signed in user
          // and to use a cookie to temporarily store information about a user logging in with a third party login provider
          app.UseCookieAuthentication(new CookieAuthenticationOptions());
          app.UseExternalSignInCookie(DefaultAuthenticationTypes.ExternalCookie);
  
          // Configure the application for OAuth based flow
          PublicClientId = "self";
          OAuthOptions = new OAuthAuthorizationServerOptions
          {
              TokenEndpointPath = new PathString("/Token"),
              Provider = new ApplicationOAuthProvider(PublicClientId),
              AuthorizeEndpointPath = new PathString("/api/Account/ExternalLogin"),
              AccessTokenExpireTimeSpan = TimeSpan.FromDays(14),
              // In production mode set AllowInsecureHttp = false
              AllowInsecureHttp = true
          };
  
          // Enable the application to use bearer tokens to authenticate users
          app.UseOAuthBearerTokens(OAuthOptions);         
      }
  </code></pre>