title: Swagger/Swashbuckle + IdentityServer4 Implicit Flow: 401 Error after successful login?
body: <p>I am trying to implement OAuth to one of my companies' projects and can't resolve the following problem.</p>
  
  <p>We used <code>IdentityServer4</code> for implementing our own Authorization Server, which works fine so far. The resource I want to protect with OAuth is a WebApi utilizing <code>Swagger/Swashbuckle</code>.</p>
  
  <p>I followed the <code>IdentityServer4 QuickStartExamples</code> to configure the server and this tutorial [Secure Web APIs with Swagger, Swashbuckle, and OAuth2 (part 2)](<a href="http://knowyourtoolset.com/2015/08/secure-web-apis-with-swagger-swashbuckle-and-oauth2-part-2" rel="nofollow noreferrer">http://knowyourtoolset.com/2015/08/secure-web-apis-with-swagger-swashbuckle-and-oauth2-part-2</a> for configuring Swagger/Swashbuckle). </p>
  
  <p>I have a dummy-action which does nothing else than returning a string, that works as expected.</p>
  
  <p>When I decorate the action with <code>[Authorize]</code>, a little red icon appears in swagger-ui, indicating that I have to log in to access this method. The Login process works fine: I am redirected to the Quickstart-UI, can login with the testuser "Bob", and I am redirected to swagger-ui after a successful login. 
  The problem: After the successful login, I still get an 401 error, stating "Authorization has been denied for this request." </p>
  
  <p>I can see that a bearer token is returned by my IdentityServer in swagger-ui, so I guess this part working fine and the problem seems to be swagger/swashbuckle.</p>
  
  <p>Is there maybe anything else I have to do with the token? In the tutorials I read so far, the swagger config is modified as I did it (see below) and that's it, so I guess swagger/swashbuckle should handle this - but maybe I miss out something?  </p>
  
  <p>SwaggerConfig.cs:</p>
  
  <pre><code>c.OAuth2("oauth2")
      .Description("OAuth2 Implicit Grant")
      .Flow("implicit") //also available: password, application (=client credentials?)
      .AuthorizationUrl("http://localhost:5000/connect/authorize")
      .TokenUrl("http://localhost:5000/connect/token")
      .Scopes(scopes =&gt;
      {
          scopes.Add("My.Web.Api", "THE Api");
  
      });
  
      // etc. .....
  
      c.OperationFilter&lt;AssignOAuth2SecurityRequirements&gt;();
  
      // etc. .....
  
  c.EnableOAuth2Support(
      clientId: "swaggerui",
      clientSecret: "secret",
      realm: "dummyrealm",
      appName: "Swagger UI"
  
  );
  </code></pre>
  
  <p>Filter for Authorize Attribute in SwaggerConfig.cs:</p>
  
  <pre><code>public class AssignOAuth2SecurityRequirements : IOperationFilter
  {
      public void Apply(Operation operation, SchemaRegistry schemaRegistry, ApiDescription apiDescription)
      {
          // Determine if the operation has the Authorize attribute
          var authorizeAttributes = apiDescription
              .ActionDescriptor.GetCustomAttributes&lt;AuthorizeAttribute&gt;();
  
          if (!authorizeAttributes.Any())
              return;
  
          // Initialize the operation.security property
          if (operation.security == null)
              operation.security = new List&lt;IDictionary&lt;string, IEnumerable&lt;string&gt;&gt;&gt;();
  
          // Add the appropriate security definition to the operation
          var oAuthRequirements = new Dictionary&lt;string, IEnumerable&lt;string&gt;&gt;
      {
          { "oauth2", new [] { "My.Web.Api" } }
      };
  
          operation.security.Add(oAuthRequirements);
      }
  }
  </code></pre>
  
  <p>IdentityServer api config:</p>
  
  <pre><code>new ApiResource("My.Web.Api", "THE  Api")
  </code></pre>
  
  <p>IdentityServer client config:</p>
  
  <pre><code>new Client
  {
      ClientId = "swaggerui",
      ClientName = "Swagger UI",
  
      AllowedGrantTypes = GrantTypes.Implicit,
      AllowAccessTokensViaBrowser = true,
      AllowedCorsOrigins = { "http://localhost:5858" },
  
      ClientSecrets =
      {
          new Secret("secret".Sha256())
      },
  
      RedirectUris = { "http://localhost:5858/swagger/ui/o2c-html" },
      PostLogoutRedirectUris = { "http://localhost:5858/swagger/ui/o2c-html" },
  
      AllowedScopes =
      {
          "My.Web.Api"
      }
  </code></pre>
  
  <p>Screenshot of redirection after login:
  <a href="https://i.stack.imgur.com/WoXeb.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/WoXeb.png" alt="Screenshot from redirect after login, still 401"></a></p>