title: .Net Core microservice and inspecting Cognito JWT claims for use in authorization
body: <p>I am developing a .net service that I am passing a Cognito generated JWT in the client that has a group claim that I hope to use to restrict API access as the JWT is passed in as a Bearer token with each API call from the front-end. e.g.</p>
  <blockquote>
  <p>&quot;cognito:groups&quot;:[&quot;Guest&quot;]</p>
  </blockquote>
  <p>In my code now I have added:</p>
  <pre><code>    services.AddAuthentication(DefaultScheme = JwtBearerDefaults.AuthenticationScheme)
    .AddJwtBearer(options =&gt;
          {
          options.TokenValidationParameters = new TokenValidationParameters
          {
              ValidateAudience = false,
              RoleClaimType = &quot;cognito:groups&quot;
          };
      });
  </code></pre>
  <p>I have setup up my roles and my permissions using the <a href="https://github.com/pdevito3/HeimGuard" rel="nofollow noreferrer">HeimGuard</a> project. In testing as I change roles in the Bearer token none of my APIs that restrict access to Guest do not deny access when decorated with [Authorize]. So, nothing is restricted. Any thoughts or ideas you have in how to solve this problem helps immensly. Thank you!!</p>