title: Azure App Service Authentication with Google oAuth 2.0 Bearer Token
body: <p>We are using App Service Authentication to protect a web API and using Google as authentication provider. It works as expected when we fire a request from a browser (when the session information is in the cookie)</p>
  
  <p>IIS log:</p>
  
  <blockquote>
    <p>2016-05-29T13:51:19  PID[3600] Verbose     Received request: GET
    <a href="https://XXXXXX.azurewebsites.net/api/user" rel="nofollow">https://XXXXXX.azurewebsites.net/api/user</a> 2016-05-29T13:51:19 
    PID[3600] Verbose     Found 'AppServiceAuthSession' cookie for site
    'XXXXXX.azurewebsites.net'. Length: 728. 2016-05-29T13:51:19 
    PID[3600] Verbose     Authenticated XXXXXX@gmail.com successfully
    using 'Session Cookie' authentication.</p>
  </blockquote>
  
  <p>But when we use API testing tool such as Postman and set the <i>Authorization</i> header with bearer token, it always results in redirection.</p>
  
  <p>IIS log:</p>
  
  <blockquote>
    <p>2016-05-29T13:53:38  PID[3600] Verbose     Received request: POST
    <a href="https://XXXXX.azurewebsites.net/api/user" rel="nofollow">https://XXXXX.azurewebsites.net/api/user</a> 2016-05-29T13:53:38 
    PID[3600] Information Redirecting:
    <a href="https://accounts.google.com/o/oauth2/v2/auth?response_type=code&amp;client_id=XXXXXXX-XXXXX7attpunn9smo4.apps.googleusercontent.com&amp;redirect_uri=https%3A%2F%2FXXXXXX.azurewebsites.net%2F.auth%2Flogin%2Fgoogle%2Fcallback&amp;scope=openid+profile+email&amp;state=nonce%3De5f4aabe11cb4544bf18d00920940d47_20160529135838%26redir%3D%2Fapi%2Fuser" rel="nofollow">https://accounts.google.com/o/oauth2/v2/auth?response_type=code&amp;client_id=XXXXXXX-XXXXX7attpunn9smo4.apps.googleusercontent.com&amp;redirect_uri=https%3A%2F%2FXXXXXX.azurewebsites.net%2F.auth%2Flogin%2Fgoogle%2Fcallback&amp;scope=openid+profile+email&amp;state=nonce%3De5f4aabe11cb4544bf18d00920940d47_20160529135838%26redir%3D%2Fapi%2Fuser</a></p>
  </blockquote>
  
  <p>We also tried to set <i>X-ZUMO-AUTH</i> header with the same bearer token, we see error as the token is not in expected format. Apparently it expects encoded JWT token.</p>
  
  <p>IIS log: </p>
  
  <blockquote>
    <p>016-05-29T13:51:52  PID[3600] Verbose     Received request: POST
    <a href="https://XXXXXX.azurewebsites.net/api/user" rel="nofollow">https://XXXXXX.azurewebsites.net/api/user</a> 2016-05-29T13:51:52 
    PID[3600] Warning     JWT validation failed: IDX10708:
    'System.IdentityModel.Tokens.JwtSecurityTokenHandler' cannot read this
    string: 'Bearer
    ya29.XXXXXXXXXX_RDrX_zsuvMx49e_9QS5ECz9F1yhDHe5j4H9gRN6opkjLXvN1IJZjHXa_Q'.
    The string needs to be in compact JSON format, which is of the form:
    '..'.. 2016-05-29T13:51:52  PID[3600]
    Information Redirecting:
    <a href="https://accounts.google.com/o/oauth2/v2/auth?response_type=code&amp;client_id=XXXXXXX-k5nj6dkf987attpunn9smo4.apps.googleusercontent.com&amp;redirect_uri=https%3A%2F%2FXXXXXX.azurewebsites.net%2F.auth%2Flogin%2Fgoogle%2Fcallback&amp;scope=openid+profile+email&amp;state=nonce%3De15b0915406142378XXXXX_20160529135652%26redir%3D%2Fapi%2Fuser" rel="nofollow">https://accounts.google.com/o/oauth2/v2/auth?response_type=code&amp;client_id=XXXXXXX-k5nj6dkf987attpunn9smo4.apps.googleusercontent.com&amp;redirect_uri=https%3A%2F%2FXXXXXX.azurewebsites.net%2F.auth%2Flogin%2Fgoogle%2Fcallback&amp;scope=openid+profile+email&amp;state=nonce%3De15b0915406142378XXXXX_20160529135652%26redir%3D%2Fapi%2Fuser</a></p>
  </blockquote>
  
  <p>Note:
  Bearer token obtained from Google is valid as we can verify the detail by making call to 
  <a href="https://www.googleapis.com/oauth2/v3/tokeninfo?access_token=[token]" rel="nofollow">https://www.googleapis.com/oauth2/v3/tokeninfo?access_token=[token]</a></p>
  
  <p>Please suggest.</p>