{"action":"closed","issue":{"url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/2326","labels_url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/2326/labels{/name}","comments_url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/2326/comments","events_url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/2326/events","html_url":"https://github.com/IdentityServer/IdentityServer3/issues/2326","id":123319806,"number":2326,"title":"How to use [ResourceAuthorize(\"...\", \"...\")] in Web Api?","user":{"login":"farzad99","id":16258460,"avatar_url":"https://avatars.githubusercontent.com/u/16258460?v=3","gravatar_id":"","url":"https://api.github.com/users/farzad99","html_url":"https://github.com/farzad99","followers_url":"https://api.github.com/users/farzad99/followers","following_url":"https://api.github.com/users/farzad99/following{/other_user}","gists_url":"https://api.github.com/users/farzad99/gists{/gist_id}","starred_url":"https://api.github.com/users/farzad99/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/farzad99/subscriptions","organizations_url":"https://api.github.com/users/farzad99/orgs","repos_url":"https://api.github.com/users/farzad99/repos","events_url":"https://api.github.com/users/farzad99/events{/privacy}","received_events_url":"https://api.github.com/users/farzad99/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-12-21T17:14:54Z","updated_at":"2015-12-21T19:27:15Z","closed_at":"2015-12-21T19:27:15Z","body":"I modified the \"MVC Authentication\" sample to be able to make an ajax call from the browser directly to the Api project using access_token. So I tested the [Authorize] on the method and it works. Then I changed it to [Authorize(Roles = \"Geek\")] and I got a 401 response; even though, the user has a \"Geek\" role. So I decided to do what was done in the the MVC project using the [ResourceAuthorize(\"Read\", \"ContactDetails\")] attribute. I added the same file to the Web Api project and added the following line to the Startup.cs of the Web Api project:\r\n\r\napp.UseResourceAuthorization(new AuthorizationManager());\r\n\r\nWhen I tested it I realized that filter isn't reached so the [ResourceAuthorize...] is ignored. \r\n\r\nSo my question is: \r\n1. How I can get this filter [ResourceAuthorize(\"Read\", \"ContactDetails\")] to work for Web Api?\r\n2. What do I need to do to get [Authorize(Roles = \"Geek\")] to work?"}}