I am implementing api auth using an OpenIdDict auth server and custom-made role based authorization. Everything works perfectly when running the api and auth server, and testing manually with Postman.

I am currently writing integration tests where api and auth server are running in-memoy using two WebApplicationFactories. All components appear to work correctly, but when the api attempts to validate the received auth token using its AuthorizationHandler, the AuthorizationHandlerContext User (ClaimsPrincipal) contains an identity as expected, but the identity does not containt the expected collection of Claims.

I have manually checked the content of the token created by the auth server using https://jwt.io/ and it looks as expected. So the issue appears to be on the API side.

Note this only happens in the integration test, not when spinning up the api and testing maually with Postman. What might be the issue here?

I won’t paste a load of code here, please let me know if you want to see something specific.

Cheers, Mike