OrchardCore.Contents API: Admin user is not able to GET a content, an error 401 unauthorized is returned, but if I grant all privileges to the "anonymous" user role, it works

[MarGraz]

Describe the bug

According to what discussed here with @hishamco, I'm opening this issue to verify it.

The module OrchardCore.Contents exposes an ApiController.cs with endpoints to create, update, and delete content items created in the "Admin" backoffice. Using Postman, it's possible to call the ApiController.cs endpoints after configuring the "OpenID Connect" OpenID Authorization Server module.

I tested this using the "Try Orchard" website. The authentication process is successful, and I receive a valid OAuth 2 token. But, when attempting to use the "Admin" user, which is supposed to have the highest privileges, I cannot perform GET, UPDATE, or DELETE operations, I receive a 401 unauthorized error. Instead, if I grant all privileges to the "anonymous" user role to call the API, and remove the OAuth token, it works.

To Reproduce

Steps to reproduce the behavior:

NOTE: As mentioned, I'm using a temporary "try.orchardcore" website, which is why I'm sharing the credentials here. They will expire along with the temporary website.

1. Import the Postman collection attached Test.postman_collection.zip (it already contains the Client Id and Secret);
2. Get an authorization token via Postman "Authorization" blade (all the fields should be already set)
3. Try to call this endpoint using GET method: https://try.orchardcore.net/jgjn0h2r/api/content/455vmd500wgrj7nqqpysw3px4s
4. You will get error 401 Unauthorized

Expected behavior

The "Admin" user**, which is supposed to have the highest privileges, must be able to retrieve a content from the GET endpoint.

Screenshots

Postman Authorization blade configuration

[MarGraz]

If you want to reproduce this in a new Orchard Core installation, you need to install and configure the "OpenID Connect" OpenID Authorization Server module. Mine is configured like in the screenshot below.

Applications:

Authorization Server:

Scopes:

Admin role permissions:

[hishamco]

@kevinchalet any idea before I try to reproduce the issue, coz you our OpenID guru :)

[kevinchalet]

A 401 HTTP response returned by the OpenIddict validation stack typically indicates a missing or invalid token (a permission issue should always result in a 403 response instead) but in this case, there's no trace of a WWW-Authenticate header in the response, which is the sure sign the challenge wasn't actually handled by OpenIddict:

@MarGraz have you enabled the OpenID validation feature? It's required if you want to use bearer token authentication in the same tenant as the authorization server.

[MarGraz]

@hishamco @kevinchalet, activating the "OpenId Token Validation" feature works 😊

I was thinking that, because the "OpenId Authorization Server" doesn't activate the "OpenId Token Validation" automatically, it was not necessary for the OpenId server to have the "OpenId Token Validation" feature. I thought it was implicit for the server to validate tokens. I expected to activate and use the "OpenId Token Validation" feature for the "OpenId Client", and not for the authorization server.

Maybe it's necessary to clarify in the description of the "OpenId Authorization Server" feature, or in the "OpenId Token Validation" feature, that activating the "OpenId Token Validation" is necessary to get tokens validated in this case.

What do you think?

Thank you so much.

Current descriptions:

[kevinchalet]

I thought it was implicit for the server to validate tokens. I expected to activate and use the "OpenId Token Validation" feature for the "OpenId Client", and not for the authorization server.

Actually, the OpenID server feature only validates tokens for endpoints it controls (e.g the userinfo endpoint). For any other endpoint, it's the OpenID token validation feature that takes care of that (there's no relationship between the token validation feature and the client feature, which is completely separate).

Maybe it's necessary to clarify in the description of the "OpenId Authorization Server" feature, or in the "OpenId Token Validation" feature, that activating the "OpenId Token Validation" is necessary to get tokens validated in this case.

Sure, feel free to send a PR to clarify the descriptions 👍🏻

[kevinchalet]

The description has been fixed in #15407. Closing.