.Net Core 2.0 Web API OpenIddict Authorization: redirecting to index instead of returning json data -

so, problem when use authorizeattribute on top of api controller, stops working expected way.

when call getallusers action, instead of returning users in json format, identity somehow redirects index.html , json parser error in angular client app, because html not valid json data can parsed.

this started happen after upgrading asp.net core 2.0.

i think perhaps have change in startup.cs or program.cs. can't figure out what.

i have followed refresh token sample on openiddict new core 2.0, , seems ok.

so here code...

startup.cs

public void configureservices(iservicecollection services)     {         services.adddbcontext<applicationdbcontext>(options => {             options.usesqlserver(configuration.getconnectionstring("localdb"))                 .useopeniddict();         });         services.addscoped<iuserrepository, userrepository>();         services.addscoped<irolerepository, rolerepository>();         services.addscoped<imanadrepository, manadrepository>();         services.addscoped<imanadrubricarepository, manadrubricarepository>();         services.addscoped<imanadsistemarepository, manadsistemarepository>();         services.addscoped<irestituicaorepository, restituicaorepository>();         services.addtransient<applicationdbseeddata>();          services.addidentity<applicationuser, applicationrole>(options =>             {                 options.user.requireuniqueemail = true;                 options.claimsidentity.usernameclaimtype = openidconnectconstants.claims.name;                 options.claimsidentity.useridclaimtype = openidconnectconstants.claims.subject;                 options.claimsidentity.roleclaimtype = openidconnectconstants.claims.role;             })             .addentityframeworkstores<applicationdbcontext>()             .adddefaulttokenproviders();          services.addopeniddict(options =>         {             options.addentityframeworkcorestores<applicationdbcontext>();             options.addmvcbinders();             options.enabletokenendpoint("/connect/token");             options.allowpasswordflow();             options.allowrefreshtokenflow();              if (!_env.isproduction())                 options.disablehttpsrequirement();         });          // add framework services.         services.addmvc();          services.addauthentication()             .addoauthvalidation();          services.addauthorization();          services.addtransient<imailsender, mailjetsender>();          services.addscoped<imanadparser, manadparser>();     }  public void configure(iapplicationbuilder app, applicationdbseeddata dbdataseeder)     {                 if (_env.isdevelopment())         {             app.usedeveloperexceptionpage();             app.usewebpackdevmiddleware(new webpackdevmiddlewareoptions             {                 hotmodulereplacement = true             });         }         else         {             app.useexceptionhandler("/home/error");         }          mapper.initialize(cfg =>         {             cfg.addprofile<automapperprofile>();         });          app.usestaticfiles();          app.useauthentication();          app.usemvc(routes =>         {             routes.maproute(                 name: "default",                 template: "{controller=home}/{action=index}/{id?}");              routes.mapspafallbackroute(                 name: "spa-fallback",                 defaults: new { controller = "home", action = "index" });         });          dbdataseeder.ensureseeddata().wait();     } 

userscontroller.cs

[route("api/[controller]")] [authorize] public class userscontroller : controller {     [httpget]     [authorize(roles = "administrador")]     public iactionresult getallusers()     {         try         {             var result = _repository.getallusers();                return ok(result);         }         catch (exception ex)         {             _logger.logerror($"failed users: {ex}");              return badrequest(ex.message);         }     } } 

if put breakpoint in getallusers method, never gets hitted. somehow because of authorization, application redirects index.html before.

program.cs

public class program {     public static void main(string[] args)     {         buildwebhost(args).run();     }      public static iwebhost buildwebhost(string[] args) =>         webhost.createdefaultbuilder(args)             .usestartup<startup>()             .build(); } 

by way, authentication working. able tokens, unable authorize controller access.

solved it. needed bit of configuration thought. add defaultauthenticatescheme option this:

services.addauthentication(options => options.defaultauthenticatescheme = oauthvalidationdefaults.authenticationscheme)             .addoauthvalidation(); 

after adding this, controller started work correctly, resulting json data , not index.html.