title: IdentityServer, ASP.NET Core and Web API
body: <p>I have setup the IdentityServer4 and another client ASP.NET Core application. 
  The Client needs to authenticate with the IdentityServer and request access to a third application which is standard MVC Web API project. </p>
  
  <p>i have followed the steps to achieve Client Credentials Flow from this example
  <a href="https://identityserver.github.io/Documentation/docsv2/overview/simplestOAuth.html" rel="nofollow">https://identityserver.github.io/Documentation/docsv2/overview/simplestOAuth.html</a></p>
  
  <p>Now I am completely lost on how to get the WEB API to first recognize the Bearer tokens and then give me some Authorization to access the web api endpoints. </p>
  
  <p>this is my IdentityServer Statrup.cs</p>
  
  <pre><code>public class Startup
  {
      public Startup(IHostingEnvironment env)
      {
          var builder = new ConfigurationBuilder()
              .SetBasePath(env.ContentRootPath)
              .AddJsonFile("appsettings.json", optional: true, reloadOnChange: true)
              .AddJsonFile($"appsettings.{env.EnvironmentName}.json", optional: true);
  
          builder.AddEnvironmentVariables();
          Configuration = builder.Build();
      }
  
      public IConfigurationRoot Configuration { get; }
  
      // This method gets called by the runtime. Use this method to add services to the container
      public void ConfigureServices(IServiceCollection services)
      {
          services.AddIdentityServer()
                  .AddInMemoryStores()
                  .AddInMemoryClients(Config.GetClients())
                  .AddInMemoryScopes(Config.GetScopes());           
      }
  
      // This method gets called by the runtime. Use this method to configure the HTTP request pipeline
      public void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerFactory loggerFactory)
      {
          loggerFactory.AddConsole(LogLevel.Debug);
          app.UseDeveloperExceptionPage();
  
          app.UseIdentityServer();
      }
  }
  </code></pre>
  
  <p>and the Config.cs</p>
  
  <pre><code> public class Config
  {
      // scopes define the resources in your system
      public static IEnumerable&lt;Scope&gt; GetScopes()
      {
          return new List&lt;Scope&gt;
          {
              new Scope
              {
                  Name = "api1"
              }
          };
      }
  
      // clients want to access resources (aka scopes)
      public static IEnumerable&lt;Client&gt; GetClients()
      {
          // client credentials client
          return new List&lt;Client&gt;
          {
              // no human involved
          new Client
          {
              ClientName = "Silicon-only Client",
              ClientId = "silicon",
              Enabled = true,
              AccessTokenType = AccessTokenType.Reference,
  
              AllowedGrantTypes = GrantTypes.ClientCredentials,
  
              ClientSecrets = new List&lt;Secret&gt;
              {
                  new Secret("F621F470-9731-4A25-80EF-67A6F7C5F4B8".Sha256())
              },
  
              AllowedScopes = new List&lt;string&gt;
              {
                  "api1"
              }
          }
          };
      }}
  </code></pre>
  
  <p>ASP.NET Core calls to the IdentityServer and Web API</p>
  
  <pre><code>[Route("api/testing")]
      public class TestingController : Controller
      {
          // GET: api/values
  
          [HttpGet]
          public IActionResult Get()
          {
              var responce = GetClientToken();
  
              return Json(new
              {
                  message = CallApi(responce)
              });
          }
  
          static TokenResponse GetClientToken()
          {
              var client = new TokenClient(
                  Constants.TokenEndpoint,
                  "silicon",
                  "F621F470-9731-4A25-80EF-67A6F7C5F4B8");
  
              return client.RequestClientCredentialsAsync("api1").Result;
          }
  
          static string CallApi(TokenResponse response)
          {
              var client = new HttpClient
              {
                  BaseAddress = new Uri(Constants.AspNetWebApiSampleApi),
                  Timeout = TimeSpan.FromSeconds(10)
              };
              client.SetBearerToken(response.AccessToken); 
              try
              {                  
                  var auth = client.GetStringAsync().Result;
                  return auth;
              }
              catch (Exception ex)
              {
                  return ex.Message;
  
              }
          }  
      }
  </code></pre>
  
  <p>So can anyone explain or share some links on what should i do to get the WEB APi (with owin middleware) to handle the calls from the ASP.NET Core client? What setting should i put in the Owin Configuration(IAppBuilder app) method. </p>