title: ASP.NET Core 2.0: Authorization failed for user: (null)
body: <p>I am building an application where Web API and IdentityServer4 are inside the same .Net Core 2.0 project. This API is consumed by Aurelia SPA web app. IdentityServer4 set to use JWT and ImplicitFlow. Everything works good (Client app gets redirected to login, gets token, sends it back on header, etc.) up to the point where user needs to be authorized in the API controller, then it just cannot authorize user, because it's null. </p>
  
  <p>There are many similar questions exists, but I tried all proposed solutions and none of them worked for me. I already spent 2 days on this issue and starting to loose hope and patience. I probably missing something obvious, but just can't find it. I posting my configs here - what is wrong with them? Will appreciate any help.</p>
  
  <p>My Startup class (I have omitted some extra things like logging, localization, etc.):</p>
  
  <pre><code>public class Startup
  {
      public Startup(IConfiguration configuration)
      {
          Configuration = configuration;
      }
  
      public IConfiguration Configuration { get; }
  
      public void ConfigureServices(IServiceCollection services)
      {
          services.AddDbContext&lt;ApplicationDbContext&gt;(options =&gt;
              options.UseSqlServer(Configuration.GetConnectionString("DefaultConnection")));
  
          services.AddIdentity&lt;ApplicationUser, IdentityRole&gt;()
              .AddEntityFrameworkStores&lt;ApplicationDbContext&gt;()
              .AddDefaultTokenProviders();
  
          services.AddCors(options =&gt;
          {
              options.AddPolicy("default", policy =&gt;
              {
                  policy.WithOrigins(Config.APP1_URL)
                      .AllowAnyHeader()
                      .AllowAnyMethod();
              });
          });
  
          services.AddMvc();
  
          services.Configure&lt;IdentityOptions&gt;(options =&gt;
          {
              // Password settings
              options.Password.RequireDigit = false;
              options.Password.RequiredLength = 8;
              options.Password.RequireNonAlphanumeric = false;
              options.Password.RequireUppercase = false;
              options.Password.RequireLowercase = false;
              options.Password.RequiredUniqueChars = 4;
  
              // Lockout settings
              options.Lockout.DefaultLockoutTimeSpan = TimeSpan.FromMinutes(30);
              options.Lockout.MaxFailedAccessAttempts = 10;
              options.Lockout.AllowedForNewUsers = true;
  
              // User settings
              options.User.RequireUniqueEmail = true;
          });
  
          services.AddIdentityServer()
              .AddDeveloperSigningCredential()
              .AddInMemoryPersistedGrants()
              .AddInMemoryIdentityResources(Config.GetIdentityResources())
              .AddInMemoryApiResources(Config.GetApiResources())
              .AddInMemoryClients(Config.GetClients())
              .AddAspNetIdentity&lt;ApplicationUser&gt;();
  
          services.AddAuthentication(IdentityServerAuthenticationDefaults.AuthenticationScheme)
              .AddIdentityServerAuthentication(options =&gt;
              {
                  options.Authority = Config.HOST_URL + "/";
                  options.RequireHttpsMetadata = false;
                  options.ApiName = "api1";
              });
      }
  
      public void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerFactory loggerFactory)
      {
          if (env.IsDevelopment())
          {
              app.UseDeveloperExceptionPage();
              app.UseBrowserLink();
              app.UseDatabaseErrorPage();
          }
          else
          {
              app.UseExceptionHandler("/Home/Error");
          }
  
          app.UseStaticFiles();
  
          app.UseIdentityServer();
  
          app.UseAuthentication();
  
          app.UseCors("default");
  
          app.UseMvc(routes =&gt;
          {
              routes.MapRoute(
                  name: "default",
                  template: "{controller=Home}/{action=Index}/{id?}");
          });
      }
  }
  </code></pre>
  
  <p>This is my Config class:</p>
  
  <pre><code>public class Config
  {
      public static string HOST_URL = "http://dev.example.com:5000";
      public static string APP1_URL = "http://dev.example.com:9000";
  
      public static IEnumerable&lt;IdentityResource&gt; GetIdentityResources()
      {
          return new List&lt;IdentityResource&gt;
          {
              new IdentityResources.OpenId(),
              new IdentityResources.Profile()
          };
      }
  
      public static IEnumerable&lt;ApiResource&gt; GetApiResources()
      {
          return new List&lt;ApiResource&gt;
          {
              new ApiResource("api1", "My API")
          };
      }
  
      public static IEnumerable&lt;Client&gt; GetClients()
      {
          return new List&lt;Client&gt;
          {
              new Client
              {
                  ClientId = "reporter",
                  ClientName = "ReporterApp Client",
                  AccessTokenType = AccessTokenType.Jwt,
                  AllowedGrantTypes = GrantTypes.Implicit,
                  RequireConsent = false,
                  AllowAccessTokensViaBrowser = true,
                  RedirectUris =
                  {
                      $"{APP1_URL}/signin-oidc"
                  },
                  PostLogoutRedirectUris = {
                      $"{APP1_URL}/signout-oidc"
                  },
                  AllowedCorsOrigins = {
                      APP1_URL
                  },
  
                  AllowedScopes =
                  {
                      IdentityServerConstants.StandardScopes.OpenId,
                      IdentityServerConstants.StandardScopes.Profile,
                      "api1"
                  }
              }
          };
      }
  }
  </code></pre>
  
  <p>And the token Aurelia app gets from IdentityServer:</p>
  
  <pre><code>{
      "alg": "RS256",
      "kid": "52155e28d23ddbab6154ce0c34511c9a",
      "typ": "JWT"
  },
  {
      "nbf": 1521195164,
      "exp": 1521198764,
      "iss": "http://dev.example.com:5000",
      "aud": ["http://dev.example.com:5000/resources", "api1"],
      "client_id": "reporter",
      "sub": "767381df-446a-4c34-af27-7bdf9e4563f3",
      "auth_time": 1521195163,
      "idp": "local",
      "scope": ["openid", "profile", "api1"],
      "amr": ["pwd"]
  }
  </code></pre>