ASP.NET

services.AddAuthorization(auth =>
{
  auth.AddPolicy(AuthPolicies.Admin, AuthPolicies.AdminPolicy());
  auth.AddPolicy(AuthPolicies.Account, AuthPolicies.AccountPolicy());                            
});

// Add all authentication schemes at once
services.AddAuthentication(option =>
{
    option.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
    option.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;

})
.AddIdentityServerJwt()
.AddCookie(option => option.SlidingExpiration = true)<br />
.AddGoogle(CertificateAuthenticationDefaults.AuthenticationScheme, option =>
{
    var googleAuthNSection = Config.GetSection("Authentication:Google");<br />
    option.ClientId = googleAuthNSection["ClientId"];
    option.ClientSecret = googleAuthNSection["ClientSecret"];
})
.AddJwtBearer(JwtBearerDefaults.AuthenticationScheme, options =>
{
    var settings = Config.GetSection("Settings");
    var secretKey = settings.GetValue<string>("Auth0:Secret");
    var authority = settings.GetValue<string>("Auth0:Authority");
    var audience = settings.GetValue<string>("Auth0:Audience");
    var issuer = settings.GetValue<string>("Auth0:Issuer");
    var expiresDays = settings.GetValue<int>("Auth0:ExpireDays");
    var signingKey = new SymmetricSecurityKey(Encoding.ASCII.GetBytes(secretKey));

    options.Audience = audience;
    options.Authority = authority;<br />
    options.SaveToken = false;
    options.RequireHttpsMetadata = false;
    options.Configuration = new OpenIdConnectConfiguration();<br />
    options.TokenValidationParameters = new TokenValidationParameters
    {
        ClockSkew = TimeSpan.FromMinutes(0),
        ValidateIssuerSigningKey = false,
        ValidateIssuer = false,
        ValidateAudience = false,
        ValidateLifetime = false,
        ValidIssuer = issuer,
        ValidAudience = audience,<br />
        IssuerSigningKey = signingKey
    };

    options.Events = new JwtBearerEvents
    {
        OnAuthenticationFailed = context =>
        {
            if (context.Exception.GetType() == typeof(SecurityTokenExpiredException))
            {
                context.Response.Headers.Add("Token-Expired", "true");
            }
            return Task.CompletedTask;
        }                    
    };
    services.AddCors();
});

public class AuthPolicies
{
    public const string Admin = "Admin";
    public const string Account = "Account";

    public static AuthorizationPolicy AdminPolicy()
    {
        return new AuthorizationPolicyBuilder()
            .AddAuthenticationSchemes("Cookies", "Bearer")
            .RequireAuthenticatedUser()
            .RequireRole(Admin)
            .RequireClaim("jti", "sub", "unique_name", "role", "idpId")<br />
            .Build();
    }

    public static AuthorizationPolicy AccountPolicy()
    {
        return new AuthorizationPolicyBuilder()
            .AddAuthenticationSchemes("Cookies", "Bearer")
            .RequireAuthenticatedUser()
            .RequireRole(Account)
            .RequireClaim("jti", "sub", "unique_name", "role", "idpId")<br />
            .Build();
    }

}

public static AuthorizationPolicy AdminPolicy()
{
    return new AuthorizationPolicyBuilder()
        .AddAuthenticationSchemes("Bearer")
        .RequireAuthenticatedUser()
        .RequireRole(Admin)                
        .RequireClaim("jti") 
        //.RequireClaim("bsonId")
        //.RequireClaim("role")
        //.RequireClaim("idpId")
        .Build();
}

public static AuthorizationPolicy AccountPolicy()
{
    return new AuthorizationPolicyBuilder()
        .AddAuthenticationSchemes("Bearer")
        .RequireAuthenticatedUser()
        .RequireRole(Account)
        .RequireClaim("jti", "sub", "unique_name", "role", "bsonId", "idpId")
        .Build();
}

"Kestrel": {
  "Certificates": {
    "Default": {
      "Path": "localhost.pfx",
      "Password": ""
    }
  }
}

Richard MacCutchan wrote:

No one here can guess what your code is doing.

signIn(): Observable<boolean> {

    let subject = new Subject<boolean>();
    this.auth2.signIn().then(user => {
      const profile = user.getBasicProfile(),
        auth = user.getAuthResponse(),
        token = localStorage.getItem("authToken");

      let gU = new SignIn();
      gU.Id = profile.getId();
      gU.FirstName = profile.getGivenName();
      gU.LastName = profile.getFamilyName();
      gU.AccountName = profile.getEmail();
      gU.Password = "2LsdFDdsfb5Ejr";
      gU.Token = token !== null ? token : "";
      gU.Role = "Account";
      gU.ExpiresAt = new Date(auth.expires_at);
      gU.IdpId = "google";
      gU.RememberMe = true;
      gU.Avatar = new Avatar();
      gU.Avatar.Url = profile.getImageUrl();

      this.validateTokenAsPromise(gU)        
        .then(user => {
          this.zone.run(() => {            
          if (user) {
            localStorage.setItem("Account", JSON.stringify(user, null, "\t"));
            if (user.Token) {
              localStorage.setItem("authToken", user.Token);
            }            
            this.user$.next(user);
            this.isLoggedIn$.next(true);
            this.auth2SignedIn.emit(true);
            subject.next(true);
          } else {
            this.isLoggedIn$.next(false);
            this.auth2SignedIn.emit(false);
            subject.next(false);
          }
        });
      },
      (err) => {
        console.error("GAuth2 Service Error", err);
        this.isLoggedIn$.next(false);
        this.auth2SignedIn.emit(false);
        subject.next(false);
      });
    });
    return subject.asObservable();
  }