title: "Authorization has been denied for this request" when hosting Azure App Service Backend locally on IIS
body: <p>In my Azure App Service .NET backend, I typically decorate my controllers with [authorize] so that they are protected against users who are not signed in. For uer authentication I set up an Azure Active Directory B2C (AADB2C) tenant, configured an application as well as some identity providers and everything works as expected as long as I am hosting my backend on Azure.</p>
  
  <p>Now, I'd like to be able to run the backend locally so that I can easily debug the code and have it work against a local development database. </p>
  
  <p>However, it does not work.</p>
  
  <ul>
  <li>I went to <a href="https://[myappservice].scm.azurewebsites.net/" rel="nofollow noreferrer">https://[myappservice].scm.azurewebsites.net/</a> and retrieved the <strong>WEBSITE_AUTH_SIGNING_KEY</strong> from the environment tab.</li>
  <li>I added the key to my backends' web.config as <strong>Signingkey</strong> under AppSettings</li>
  <li>I changed <strong>ValidAudience</strong> and <strong>ValidIssuer</strong> to the respective values (<a href="https://[myappservice].azurewebsites.net" rel="nofollow noreferrer">https://[myappservice].azurewebsites.net</a>)</li>
  <li>So that I can bind the backend to an IP address or my hosts name rather than "localhost" (which would be the case with IIS Express), I configured the backend to run under IIS</li>
  <li>I only allowed anonymous access on my IIS Website and let it run under the DefaultAppPool which uses the integrated pipeline on the 4.0 CLR</li>
  </ul>
  
  <p>My client code does not use MobileServiceClient but MSAL (PublicClientApplication). So the documentation about how to setup a local dev environment found <a href="https://github.com/Azure/azure-mobile-apps-net-server/wiki/Local-development-and-debugging-the-Mobile-App-.NET-server-backend" rel="nofollow noreferrer">here</a> does not apply.</p>
  
  <p>Because I have a RequestProvider class that creates the necessary HttpClient and adds the access token to the header, this shouldn't be a problem, because for authentication, the PublicClientApplication object uses the AADB2C tenant and the respective server flow policies for signing in and -up and for calling the backends' rest controller I can switch between the Azure hosted and the locally hosted backend.</p>
  
  <p>However, while authentication keeps working like a charm and I am able to receive a working access token, the backend that is hosted locally does not accept it while the same backend code hosted on azure does.</p>
  
  <p>So I started searching the net and found out about the website <a href="https://jwt.io" rel="nofollow noreferrer">jwt.io</a>. I pasted my access token into their decoder and was astonished about the result.</p>
  
  <p>Some article mentioned that the values <strong>ValidIssuer</strong> and <strong>ValidAudience</strong> configured in the backends' web.config need to exactly reflect the values <strong>iss</strong> and <strong>aud</strong> contained within the access token.</p>
  
  <p>The values in <em>my</em> access token however don't match the scheme which was part of the web.config template though (<a href="https://[myappservice].azurewebsites.net" rel="nofollow noreferrer">https://[myappservice].azurewebsites.net</a>).</p>
  
  <p>The <strong>iss</strong> field in <em>my</em> decoded token looked like this:</p>
  
  <pre><code>https://[myappservice].b2clogin.com/12345678-1234-1234-1234-123456789012/v2.0/
  </code></pre>
  
  <p>The <strong>aud</strong> field in <em>my</em> decoded token looked like this:</p>
  
  <pre><code>12345678-1234-1234-1234-123456789012
  </code></pre>
  
  <p>The isser value can be found in my <strong>AADb2C tenants' directory</strong> within the signin/-up <strong>policies' settings</strong> under <strong>Properties</strong> in "Token compatibility settings" as <strong>Issuer (iss) claim</strong>. Theres a combobox from which the following value is selected:</p>
  
  <pre><code>https://&lt;domain&gt;/12345678-1234-1234-1234-123456789012/v2.0/
  </code></pre>
  
  <p>The <strong>aud</strong> fields' guid equals the <strong>Client ID</strong> configured in the App Service on Azure.</p>
  
  <p>However, even if I take <em>these two values</em> and enter them into the web.config as described above, I still get an "Authorization has been denied for this request" error.</p>
  
  <p>I really don't know how to get this working...</p>