Leahn

SaveToken does nothing. It stores the token on the request so the server can send it back on every response. But I already have the token so this is not needed. It's no longer the standard to use it and the most recent articles say not to use it.

And I am adding the Authorization Header. That won't create a Identity Principal by itself.

It's a microservice architecture. A request is an get or post request to an API endpoint. Token is an access token, according to OpenID standards.

I'm creating a SSO Middleware that intercepts calls to [Authorize] endpoints.

If the user is not Authorized (Context.User.Identity.IsAuthorized is false), he's forcefully redirected (Response.Redirect, Status Code 302), to another server /auth endpoint which works as a universal login (as in, both desktop and mobile and all apps). This other server is not under my control or purview. It returns an auth code, which I then exchange for an access token and refresh token, according to OpenID standards.

I am not using OpenID Middleware. I'm using JWT Bearer. I was kind of ordered to do so.