title: Ocelot RouteClaimsRequirement does not recognize my claims and returns 403 Forbidden
body: <p>I have configured ocelot in Linux containers with multiple micro service. For restricting some of the micro services I'm using <code>RouteClaimsRequirement</code>. I have administrator role as claim, but when I send token with role administrator the Ocelot returns 403 Forbidden, which is the HttpCode for <strong>not</strong> meeting the criteria in <code>RouteClaimsRequirement</code>. If I delete the <code>RouteClaimsRequirment</code> from <code>ocelot.json</code> everything is working.</p>
  <pre><code>   {
    &quot;DownstreamPathTemplate&quot;: &quot;/api/v1/product/{everything}&quot;,
    &quot;DownstreamScheme&quot;: &quot;https&quot;,
    &quot;DownstreamHostAndPorts&quot;: [
      {
        &quot;Host&quot;: &quot;product&quot;,
        &quot;Port&quot;: 443
      }
    ],
    &quot;UpstreamPathTemplate&quot;: &quot;/product/{everything}&quot;,
    &quot;UpstreamHttpMethod&quot;: [ &quot;Get&quot;, &quot;Post&quot;, &quot;Delete&quot; ],
    &quot;AuthenticationOptions&quot;: {
      &quot;AuthenticationProviderKey&quot;: &quot;Bearer&quot;,
      &quot;AllowedScopes&quot;: []
    },
    &quot;RouteClaimsRequirement&quot;: {  &lt;---- Problem Part
      &quot;Role&quot;: &quot;Administrator&quot;
    },
    &quot;DangerousAcceptAnyServerCertificateValidator&quot;: true,
    &quot;RateLimitOptions&quot;: {
      &quot;ClientWhitelist&quot;: [],
      &quot;EnableRateLimiting&quot;: true,
      &quot;Period&quot;: &quot;5s&quot;,
      &quot;PeriodTimespan&quot;: 6,
      &quot;Limit&quot;: 8
    }
  }
  </code></pre>
  <p>Here how the ocelot project startup class looks like:</p>
  <pre><code>public void ConfigureServices(IServiceCollection services)
  =&gt; services
      .AddCors()
      .AddTokenAuthentication(Configuration)
      .AddOcelot();
  
  public static IServiceCollection AddTokenAuthentication(
      this IServiceCollection services,
      IConfiguration
       configuration,
      JwtBearerEvents events = null)
  {
      var secret = configuration
          .GetSection(nameof(ApplicationSettings))
          .GetValue&lt;string&gt;(nameof(ApplicationSettings.Secret));
  
      var key = Encoding.ASCII.GetBytes(secret);
  
      services
          .AddAuthentication(authentication =&gt;
          {
              authentication.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
              authentication.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
          })
          .AddJwtBearer(bearer =&gt;
          {
              bearer.RequireHttpsMetadata = false;
              bearer.SaveToken = true;
              bearer.TokenValidationParameters = new TokenValidationParameters
              {
                  ValidateIssuerSigningKey = true,
                  IssuerSigningKey = new SymmetricSecurityKey(key),
                  ValidateIssuer = false,
                  ValidateAudience = false
              };
  
              if (events != null)
              {
                  bearer.Events = events;
              }
          });
  
      services.AddHttpContextAccessor();
      services.AddScoped&lt;ICurrentUserService, CurrentUserService&gt;();
  
      return services;
  
  }
  
  public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
  {
      app
          .UseCors(options =&gt; options
              .AllowAnyOrigin()
              .AllowAnyHeader()
              .AllowAnyMethod())
          .UseAuthentication()
          .UseAuthorization()
          .UseOcelot().Wait();
  }
  </code></pre>
  <p>Token generation looks like this:</p>
  <pre><code>    public string GenerateToken(User user, IEnumerable&lt;string&gt; roles = null)
      {
          var tokenHandler = new JwtSecurityTokenHandler();
          var key = Encoding.ASCII.GetBytes(this.applicationSettings.Secret);
  
          var claims = new List&lt;Claim&gt;
          {
              new Claim(ClaimTypes.NameIdentifier, user.Id),
              new Claim(ClaimTypes.Name, user.Email)
          };
  
          if (roles != null)
          {
              claims.AddRange(roles.Select(role =&gt; new Claim(ClaimTypes.Role, role)));
          }
  
          var tokenDescriptor = new SecurityTokenDescriptor
          {
              Subject = new ClaimsIdentity(claims),
              Expires = DateTime.UtcNow.AddDays(7),
              SigningCredentials = new SigningCredentials(
                  new SymmetricSecurityKey(key),
                  SecurityAlgorithms.HmacSha256Signature)
          };
  
          var token = tokenHandler.CreateToken(tokenDescriptor);
          var encryptedToken = tokenHandler.WriteToken(token);
  
          return encryptedToken;
      }
  </code></pre>
  <p>Decrypted token:</p>
  <pre><code>{
    &quot;nameid&quot;: &quot;e18d5f1f-a315-435c-9e38-df9f2c77ad20&quot;,
    &quot;unique_name&quot;: &quot;test@aa.bg&quot;,
    &quot;role&quot;: &quot;Administrator&quot;,
    &quot;nbf&quot;: 1595460189,
    &quot;exp&quot;: 1596064989,
    &quot;iat&quot;: 1595460189
  }
  </code></pre>