I've been intently looking at this article: http://www.asp.net/aspnet/overview/owin-and-katana/owin-oauth-20-authorization-server.
It seems that I got the authorization server to work because I'm able to obtain access and refresh tokens with the implicit, authorization code, resource owner credentials, and client credentials flows.
I'm having a problem with the resource server implementation as described in the article. I feel that there needs to be more settings on the resource server side that the article does not specify (does not even mention that there needs to be more settings
provided that the article won't address). If I put the [Authorize] attribute on the Me controller, every request, even with a header Authorization: Bearer {{token here generated from the auth server}} will result in a 401.
I'm accustomed to writing a delegating handler to "intercept" requests before hitting up API controllers - which would look for the access token i ...
Go to the complete details ...