{"action":"created","issue":{"url":"https://api.github.com/repos/IdentityServer/IdentityServer3.AccessTokenValidation/issues/31","labels_url":"https://api.github.com/repos/IdentityServer/IdentityServer3.AccessTokenValidation/issues/31/labels{/name}","comments_url":"https://api.github.com/repos/IdentityServer/IdentityServer3.AccessTokenValidation/issues/31/comments","events_url":"https://api.github.com/repos/IdentityServer/IdentityServer3.AccessTokenValidation/issues/31/events","html_url":"https://github.com/IdentityServer/IdentityServer3.AccessTokenValidation/issues/31","id":83208763,"number":31,"title":"using UseIdentityServerBearerTokenAuthentication","user":{"login":"stevenfirstrowinc","id":7965187,"avatar_url":"https://avatars.githubusercontent.com/u/7965187?v=3","gravatar_id":"","url":"https://api.github.com/users/stevenfirstrowinc","html_url":"https://github.com/stevenfirstrowinc","followers_url":"https://api.github.com/users/stevenfirstrowinc/followers","following_url":"https://api.github.com/users/stevenfirstrowinc/following{/other_user}","gists_url":"https://api.github.com/users/stevenfirstrowinc/gists{/gist_id}","starred_url":"https://api.github.com/users/stevenfirstrowinc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stevenfirstrowinc/subscriptions","organizations_url":"https://api.github.com/users/stevenfirstrowinc/orgs","repos_url":"https://api.github.com/users/stevenfirstrowinc/repos","events_url":"https://api.github.com/users/stevenfirstrowinc/events{/privacy}","received_events_url":"https://api.github.com/users/stevenfirstrowinc/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/IdentityServer/IdentityServer3.AccessTokenValidation/labels/question","name":"question","color":"cc317c"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2015-05-31T22:32:07Z","updated_at":"2015-06-01T03:12:06Z","closed_at":null,"body":"I'm using the following code to ensure my access token is correct\r\n\r\n````\r\n            JwtSecurityTokenHandler.InboundClaimTypeMap = ClaimMappings.None;\r\n\r\n            app.UseIdentityServerBearerTokenAuthentication(new IdentityServerBearerTokenAuthenticationOptions\r\n            {\r\n                Authority = \"https://localhost:44310/identity\",\r\n                RequiredScopes = new[] { \"csRA\" },\r\n            });\r\n````\r\nI was expecting that any request that came through that did not have this scope would return a 404 and exit the pipeline, but instead it seems as though the pipeline continues with an unauthenticated user instead.\r\n\r\nI'm using Owin and WebApi 2.2 and the above are the first lines in my startup class.  Should I be adding this method to the end of my startup instead?"},"comment":{"url":"https://api.github.com/repos/IdentityServer/IdentityServer3.AccessTokenValidation/issues/comments/107293707","html_url":"https://github.com/IdentityServer/IdentityServer3.AccessTokenValidation/issues/31#issuecomment-107293707","issue_url":"https://api.github.com/repos/IdentityServer/IdentityServer3.AccessTokenValidation/issues/31","id":107293707,"user":{"login":"brockallen","id":649492,"avatar_url":"https://avatars.githubusercontent.com/u/649492?v=3","gravatar_id":"","url":"https://api.github.com/users/brockallen","html_url":"https://github.com/brockallen","followers_url":"https://api.github.com/users/brockallen/followers","following_url":"https://api.github.com/users/brockallen/following{/other_user}","gists_url":"https://api.github.com/users/brockallen/gists{/gist_id}","starred_url":"https://api.github.com/users/brockallen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/brockallen/subscriptions","organizations_url":"https://api.github.com/users/brockallen/orgs","repos_url":"https://api.github.com/users/brockallen/repos","events_url":"https://api.github.com/users/brockallen/events{/privacy}","received_events_url":"https://api.github.com/users/brockallen/received_events","type":"User","site_admin":false},"created_at":"2015-06-01T03:12:06Z","updated_at":"2015-06-01T03:12:06Z","body":"You mean authorization, right? The bearer token is authentication. If that works, then great, but if not then the request is anonymous. Authorization ensures that the current request is allowed. If anonymous is not allowed, then that authorization is required."}}