title: Why is ASP.NET Core Identity 2.0 Authorize filter causing me to get a 404?
body: <p>I have a controller that I want to restrict only to a specific role, let's say <code>admin</code>. After setting a user with the <code>admin</code> role, I can validate that he's on that role using the <code>IsInRoleAsync</code> method (which returns true). When setting the attribute with <code>[Authorize(Roles = "admin")]</code> I get a 404 with that very same user . I'm using bearer tokens (I don't think that is relevant but anyway) and here's what I've done to try debugging:</p>
  
  <p>Controller w/o <code>[Authorize]</code> : the resource is returned. [OK]</p>
  
  <p>Controller with <code>[Authorize]</code> : the resource is returned <em>only</em> when I use the <code>Authentication: Bearer [access token]</code> [OK]</p>
  
  <p>Controller with <code>[Authorize(Roles = "admin")]</code> : even after logging in with the user that has the role set, I get the 404 [NOK]</p>
  
  <p>I don't know if I'm missing some configuration, but here's my ConfigureServices:</p>
  
  <pre><code>public void ConfigureServices(IServiceCollection services)
  {
      services.AddMvc();
  
      // Add framework services.
      services.AddDbContext&lt;ApplicationDbContext&gt;(options =&gt;
      {
          options.UseSqlServer(Configuration.GetConnectionString("DefaultConnection"));
          options.UseOpenIddict();
      });
      services.AddIdentity&lt;ApplicationUser, IdentityRole&gt;()
          .AddEntityFrameworkStores&lt;ApplicationDbContext&gt;()
          .AddDefaultTokenProviders();
  
      services.AddOpenIddict(opt =&gt;
      {
          opt.AddEntityFrameworkCoreStores&lt;ApplicationDbContext&gt;();
          opt.AddMvcBinders();
          opt.EnableTokenEndpoint("/api/token");
          opt.AllowPasswordFlow();
          opt.DisableHttpsRequirement(); //for dev only!
          opt.UseJsonWebTokens();
          opt.AddEphemeralSigningKey();
          opt.AllowRefreshTokenFlow();
          opt.SetAccessTokenLifetime(TimeSpan.FromMinutes(5));
      });
  
      services.AddAuthentication(options =&gt;
      {
          options.DefaultScheme = OAuthValidationDefaults.AuthenticationScheme;
          options.DefaultAuthenticateScheme = OAuthValidationConstants.Schemes.Bearer;
          options.DefaultSignInScheme = IdentityConstants.ExternalScheme;
      })
         .AddJwtBearer(options =&gt;
         {
             options.Authority = "http://localhost:44337/";
             options.Audience = "resource_server";
             options.RequireHttpsMetadata = false;
             options.TokenValidationParameters = new TokenValidationParameters
             {
                 NameClaimType = OpenIdConnectConstants.Claims.Subject,
                 RoleClaimType = OpenIdConnectConstants.Claims.Role
             };                   
         });
      services.Configure&lt;IdentityOptions&gt;(options =&gt;
      {
          // Password settings
          options.Password.RequireDigit = true;
          options.Password.RequiredLength = 8;
          options.Password.RequireNonAlphanumeric = false;
          options.Password.RequireUppercase = true;
          options.Password.RequireLowercase = false;
  
          // Lockout settings
          options.Lockout.DefaultLockoutTimeSpan = TimeSpan.FromMinutes(30);
          options.Lockout.MaxFailedAccessAttempts = 10;
          // User settings
          options.User.RequireUniqueEmail = true;
          // Add application services.
          options.ClaimsIdentity.UserNameClaimType= OpenIdConnectConstants.Claims.Name;
          options.ClaimsIdentity.UserIdClaimType = OpenIdConnectConstants.Claims.Subject;
          options.ClaimsIdentity.RoleClaimType = OpenIdConnectConstants.Claims.Role;
      });
  
      services.AddSingleton(typeof(RoleManager&lt;ApplicationUser&gt;));
      // Add application services.
      services.AddTransient&lt;IEmailSender, AuthMessageSender&gt;();
      services.AddTransient&lt;ISmsSender, AuthMessageSender&gt;();
  </code></pre>