I’m trying to register 2 .NET Identity Authentication to the same API. I plan to add more in the future.

The idea is to use a first identity to authenticate the API users (the different branches of our group), and then for each branch, an identity for their own users. So in a first part the web app will authenticate in the API through the first Identity (getting access to some common services for all users) and then if branch user authenticates to its dedicated branch identity, he will be able to access his account details.

I am expecting to achieve this using 2 JWT token: 1 to access the common services, 1 to access branch dedicated services.

I have created my 2 identity projects, and I inject them into my API.

[enter image description here](https://i.sstatic.net/AeWe7g8J.png

Code to inject the first identity (the common one):

public static class ApiIdentityServicesRegistration
{
    public static IServiceCollection AddApiIdentityServices(this IServiceCollection services, IConfiguration configuration)
    {
        services.Configure<JwtSettings>(configuration.GetSection("ApiJwtSettings"));
        services.AddDbContext<ApiDbContext>(options =>
        {
            options.UseSqlServer(configuration.GetConnectionString("API_IDENTITY"));
        });

        services.AddIdentity<ApiApplicationUser, IdentityRole>()
            .AddEntityFrameworkStores<ApiDbContext>()
            .AddDefaultTokenProviders();

        services.AddTransient<IApiUserRepository, UserService>();

        services
            .AddAuthentication()
            .AddJwtBearer("Bearer_ApiUser", o =>
        {
            o.TokenValidationParameters = new Microsoft.IdentityModel.Tokens.TokenValidationParameters
            {
                ValidateIssuerSigningKey = true,
                ValidateIssuer = true,
                ValidateAudience = true,
                ValidateLifetime = true,
                ClockSkew = TimeSpan.Zero,
                ValidIssuer = configuration["ApiJwtSettings:Issuer"],
                ValidAudience = configuration["ApiJwtSettings:Audience"],
                IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(configuration["ApiJwtSettings:Key"]))
            };
        });
        services.AddAuthorization();

        services.ConfigureApplicationCookie(options =>
        {
            options.Cookie.Name = "AajApiToken";
        });

        return services;
    }
}

And here is the second one (the branch one):

public static class AajIdentityServicesRegistration
{
    public static IServiceCollection AddAajIdentityServices(this IServiceCollection services, IConfiguration configuration)
    {
        services.Configure<JwtSettings>(configuration.GetSection("AajJwtSettings"));
        services.AddDbContext<AajDbContext>(options =>
        {
            options.UseSqlServer(configuration.GetConnectionString("AAJ_IDENTITY"));
        });

        services.AddIdentityCore<AajApplicationUser>()
            .AddEntityFrameworkStores<AajDbContext>()
            .AddDefaultTokenProviders()
            .AddSignInManager<SignInManager<AajApplicationUser>>();

        services.AddTransient<IAajUserRepository, AajUserService>();

        services
            .AddAuthentication()
            .AddJwtBearer("Bearer_AajUser",o =>
        {
            o.TokenValidationParameters = new TokenValidationParameters
            {
                ValidateIssuerSigningKey = true,
                ValidateIssuer = true,
                ValidateAudience = true,
                ValidateLifetime = true,
                ClockSkew = TimeSpan.Zero,
                ValidIssuer = configuration["AajJwtSettingsJwtSettings:Issuer"],
                ValidAudience = configuration["AajJwtSettings:Audience"],
                IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(configuration["AajJwtSettings:Key"]))
            };
        });
        services.ConfigureApplicationCookie(options =>
        {
            options.Cookie.Name = "AajUserToken";
        });
        return services;
    }
}

And then in the API I use

[Authorize(AuthenticationSchemes = "Bearer_ApiUser")]

to make sure only authorize API user will access the common services.

When testing, I can login, using the main Identity. I got my token without issue, but when I try to use common services, I got a 401 error without any specific error message.

Note 1: I keep different identity for each branch because user class fields and claims type are very different from branch to branch. Also, some user may be registered in 2 different branches, expecting different services for each.

Note 2: I have tested my API without [Authorize] and it was working fine.

I didn’t try much as I can’t get any details on that error. I have no idea of how I can debug this [Authorize] feature.