title: Securing WebApi using open ID connect
body: <p>I have having a problem when trying to secure a Web API service using OpenId connect and ADFS 2016.</p>
  
  <p>I have a mobile native client which successfully gets an access, refresh and Id token from ADFS after entering their credentials into the presented logon page.</p>
  
  <p>However when I use that token to access my simple web api method it always presents the logon page</p>
  
  <p>Here is my Startup.cs</p>
  
  <pre><code>public partial class Startup
  {
          public void ConfigureAuth(IAppBuilder app)
          {
              app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);
  
              var cookieAuthenticationOptions = new CookieAuthenticationOptions();
              app.UseCookieAuthentication(cookieAuthenticationOptions);
  
  
  
              var openIdConnectAuthenticationOptions = new OpenIdConnectAuthenticationOptions
              {
                  ClientId = "**&lt;myclientid&gt;**",
                  MetadataAddress = "https://**&lt;myFullyQualifiedDomainName&gt;**/adfs/.well-known/openid-configuration",
                  PostLogoutRedirectUri = "my.client.native://callback",
                  RedirectUri = "my.client.native://callback",
                  Notifications = new OpenIdConnectAuthenticationNotifications
                  {
                      RedirectToIdentityProvider = (context) =&gt;
                      {
                          Debug.WriteLine("*** RedirectToIdentityProvider");
                          return Task.FromResult(0);
                      },
                      MessageReceived = (context) =&gt;
                      {
                          Debug.WriteLine("*** MessageReceived");
                          return Task.FromResult(0);
                      },
                      SecurityTokenReceived = (context) =&gt;
                      {
                          Debug.WriteLine("*** SecurityTokenReceived");
                          return Task.FromResult(0);
                      },
                      SecurityTokenValidated = (context) =&gt;
                      {
                          Debug.WriteLine("*** SecurityTokenValidated");
                          return Task.FromResult(0);
                      },
                      AuthorizationCodeReceived = (context) =&gt;
                      {
                          Debug.WriteLine("*** AuthorizationCodeReceived");
                          return Task.FromResult(0);
                      },
                      AuthenticationFailed = (context) =&gt;
                      {
                          Debug.WriteLine("*** AuthenticationFailed");
                          return Task.FromResult(0);
                      }
  
                  }
              };
  
              app.UseOpenIdConnectAuthentication(openIdConnectAuthenticationOptions);
  
  
          }
      }
  </code></pre>
  
  <p>When I make a call to my Web API GET method I am seeing the the open id options notification for RedirectToIdentifyProvider being hit in the debugger, none of the other notifications are hit. I assume at this point it has decided that the logon page should be presented again. So what I get in the the response to my HTTP GET is the html of the ADFS logon page.</p>
  
  <p>Has anyone got any ideas about how to get this to work with a native client attempting to access a webapi service method? As far as I can tell this is correct. My problem is that most of the exaples out there are for a web page accessing Web Api. I'm not sure about setting the authentication type to use cookies. Is that correct?</p>
  
  <p>Also should I be using app.UseOpenIdConnectAuthentication for a native client, or should I be using a different OWIN middleware.</p>
  
  <p>Any input would be appreciated as I have spent well over a week trying to figure out what is wrong.</p>
  
  <p>Thanks in advance.</p>