title: How to Configure Swagger in .NET Core 2.2 WebApi and Azure AD 2.0?
body: <p>I have a problem with the "authorize" functionality of the Swagger to authenticate a WebApi application using Azure AD 2.0 endpoint. I used the following settings in my startup class, but the acquired token fails to validate the bearer token inside the Swagger. The API works fine with the token sent by the react client.</p>
  
  <pre><code>private const string AzureAdConfigKey = "AzureAd";
  private const string OAuth2Definition = "openid";
  
  private IConfiguration Configuration { get; }
  private IHostingEnvironment Environment { get; }
  
  public Startup(IConfiguration configuration, IHostingEnvironment environment)
  {
      Environment = environment;
      Configuration = configuration;
  }
  
  public void ConfigureServices(IServiceCollection services)
  {
      services.AddAuthentication(AzureADDefaults.JwtBearerAuthenticationScheme)
          .AddAzureADBearer(options =&gt; Configuration.Bind(AzureAdConfigKey, options));
  
      services.Configure&lt;JwtBearerOptions&gt;(AzureADDefaults.JwtBearerAuthenticationScheme,
          options =&gt; options.Authority += "/v2.0");
  
      var authorizationPolicy = new AuthorizationPolicyBuilder()
          .RequireAuthenticatedUser()
          .Build();
  
      services.AddMvc(options =&gt; options.Filters.Add(new AuthorizeFilter(authorizationPolicy)))
          .SetCompatibilityVersion(CompatibilityVersion.Version_2_2);
  
      var azureAdAuthority = $"https://login.microsoftonline.com/{Configuration["AzureAd:TenantId"]}/oauth2/v2.0";
      services.AddSwaggerGen(options =&gt;
      {
          options.SwaggerDoc("v1", new Info
          {
              Title = "My Api Name",
              Version = "v1"
          });
  
          options.AddSecurityDefinition(OAuth2Definition, new OAuth2Scheme
          {
              Description = "OAuth2 Implicit Grant",
              Flow = "implicit",
              AuthorizationUrl = $"{azureAdAuthority}/authorize",
              TokenUrl = $"{azureAdAuthority}/connect/token",
              Scopes = new Dictionary&lt;string, string&gt;
              {
                  {OAuth2Definition, "User.Read"}
              }
          });
  
          options.AddSecurityRequirement(new Dictionary&lt;string, IEnumerable&lt;string&gt;&gt; {{OAuth2Definition, null}});
      });
  
      services.AddCors(options =&gt; options.AddPolicy("AllowSpecificOrigin", builder =&gt; builder
          .WithOrigins(Configuration["MyAppClientUrl"])
          .AllowCredentials()
          .AllowAnyHeader()
          .AllowAnyMethod()
      ));
  
      // Other Service Registrations.
  }
  
  public void Configure(IApplicationBuilder app, IHostingEnvironment env)
  {
      app.UseMiddleware&lt;ErrorHandlingMiddleware&gt;();
  
      app.UseCors("AllowSpecificOrigin");
  
      app.UseHsts();
      app.UseHttpsRedirection();
  
      app.UseSwagger();
      app.UseSwaggerUI(config =&gt;
      {
          const string swaggerName = "MyApp Coding Api";
          const string swaggerUrl = "/swagger/v1/swagger.json";
  
          config.SwaggerEndpoint(swaggerUrl, swaggerName);
          config.RoutePrefix = string.Empty;
  
          config.OAuthAppName(swaggerName);
          config.OAuthClientId(Configuration["AzureAd:ClientId"]);
          config.OAuthClientSecret(Configuration["AzureAd:ClientSecret"]);
          // This is my Api local path.
          config.OAuthRealm("https://localhost:44398/swagger/ui/o2c-html");
          config.OAuthScopeSeparator(" ");
      });
  
      app.UseAuthentication();
      app.UseMvc();
  }
  </code></pre>
  
  <p>The following is the token generated by the client, which works fine and implements .v2.0:</p>
  
  <pre><code>{
    "aud": "{Excldued}",
    "iss": "https://login.microsoftonline.com/{Excldued}/v2.0",
    "iat": 1556730915,
    "nbf": 1556730915,
    "exp": 1556734815,
    "aio": "AVQAq/8LAAAA9lULrpdFyoAfnaWTCkdo8PMz2vL4C0MbDNAxmRBa3rMETsjpnXYFb5izdF/VRWMLzOvwgmw9Zt3zzisWRbLCFMd5KAaJ59wUDqNdSoawS6U=",
    "name": "{Excldued}",
    "nonce": "{Excldued}",
    "oid": "{Excldued}",
    "preferred_username": "{Excldued}",
    "roles": [
      "Coder",
      "Supervisor"
    ],
    "sub": "Jn0w0rhsGpwTKPdSjQBLHeHDv2_TD4kaOjo0x06JWKQ",
    "tid": "{Excldued}",
    "uti": "pOW4Q_EBdkSv_q0-OHRSAA",
    "ver": "2.0"
  }
  </code></pre>
  
  <p>But the swagger generates the following token, which is .v1.0:</p>
  
  <pre><code>{
    "aud": "00000003-0000-0000-c000-000000000000",
    "iss": "https://sts.windows.net/{Excluded}/",
    "iat": 1556733552,
    "nbf": 1556733552,
    "exp": 1556737452,
    "acct": 0,
    "acr": "1",
    "aio": "AUQAu/8LAAAA9YXDyeK8KuCHbNgw7RGU8GgJk3qpWB1H+Q3i/dC/VRoAtYvp3NHFIYcTFxn3jfTPvvXRWx5MN35kvO0iCK7ftg==",
    "amr": [
      "pwd",
      "mfa"
    ],
    "app_displayname": "{Excluded}",
    "appid": "{Excluded}",
    "appidacr": "0",
    "family_name": "{Excluded}",
    "given_name": "{Excluded}",
    "ipaddr": "{Excluded}",
    "name": "{Excluded}",
    "oid": "{Excluded}",
    "onprem_sid": "{Excluded}",
    "platf": "3",
    "puid": "{Excluded}",
    "scp": "openid profile User.Read email",
    "signin_state": [
      "kmsi"
    ],
    "sub": "{Excluded}",
    "tid": "{Excluded}",
    "unique_name": "{Excluded}",
    "upn": "{Excluded}",
    "uti": "{Excluded}",
    "ver": "1.0",
    "xms_st": {
      "sub": "{Excluded}"
    },
    "xms_tcdt": 1361394419
  }
  </code></pre>
  
  <p>What am I doing wrong in my Swagger configuration that requests 1.0 endpoint and gets the wrong token type?</p>
  
  <h2>UPDATE:</h2>
  
  <p>This is the fiddler request to the Azure AD authorize endpoint:</p>
  
  <pre><code>GET https://login.microsoftonline.com/{TenantId}/oauth2/v2.0/authorize?response_type=token&amp;client_id={ClientId}&amp;redirect_uri=https%3A%2F%2Flocalhost%3A44350%2Foauth2-redirect.html&amp;scope=openid&amp;state={StateValue}&amp;nonce=123456 HTTP/1.1
  Host: login.microsoftonline.com
  Connection: keep-alive
  Upgrade-Insecure-Requests: 1
  DNT: 1
  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.157 Safari/537.36
  Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
  Referer: https://localhost:44350/index.html
  Accept-Encoding: gzip, deflate, br
  Accept-Language: en-US,en;q=0.9
  </code></pre>