集成FusionAuth至.NET Core API：传入有效Token仍返回401求排查

我正在将FusionAuth集成到我的.NET Core API中，Program.cs代码如下：

using Microsoft.AspNetCore.Authentication.JwtBearer;
using Microsoft.AspNetCore.Authorization;
using Microsoft.IdentityModel.Tokens;
using System.Text;


var builder = WebApplication.CreateBuilder(args);

// Add services to the container.

builder.Services.AddControllers();
// Learn more about configuring Swagger/OpenAPI at https://aka.ms/aspnetcore/swashbuckle
builder.Services.AddEndpointsApiExplorer();
builder.Services.AddSwaggerGen();

builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
.AddJwtBearer("FA", options =>
{
    options.SaveToken = true;
    options.TokenValidationParameters = new TokenValidationParameters
    {
        ValidateIssuer = true,
        ValidateAudience = false,
        ValidateLifetime = true,
        ValidateIssuerSigningKey = true,
        ValidIssuer = builder.Configuration.GetValue<string>("Jwt:Issuer"),
        IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(builder.Configuration.GetValue<string>("Jwt:Key")))
    };
});

builder.Services.AddAuthorization(options =>
{
    options.DefaultPolicy = new AuthorizationPolicyBuilder()
        .AddAuthenticationSchemes("FA")
        .RequireAuthenticatedUser()
        .Build();
});


builder.Services.AddAuthorization(options =>
{
    options.AddPolicy("FA", policy =>
    {
        policy.AddAuthenticationSchemes("FA");
        policy.RequireAuthenticatedUser();
        //policy.RequireClaim("scope", "licensing");
        policy.Build();
    });
});

// Services
builder.Services.AddScoped<IAccountService, AccountService>();

builder.Services.Configure<FusionConfiguration>(options => builder.Configuration.GetSection("FusionConfiguration").Bind(options));

var app = builder.Build();

// Configure the HTTP request pipeline.
if (app.Environment.IsDevelopment())
{
    app.UseSwagger();
    app.UseSwaggerUI();
}



app.UseHttpsRedirection();
app.UseAuthentication();
app.UseAuthorization();

app.MapControllers();

app.Run();

我已为一个默认控制器方法添加了认证特性：

[HttpGet("GetWeatherForecast"), Authorize(policy: "FA")]
public IEnumerable<WeatherForecast> GetWeatherForecast()
{
    return Enumerable.Range(1, 5).Select(index => new WeatherForecast
    {
        Date = DateTime.Now.AddDays(index),
        TemperatureC = Random.Shared.Next(-20, 55),
        Summary = Summaries[Random.Shared.Next(Summaries.Length)]
    })
    .ToArray();
}

当我完成认证获取到Token后，通过Postman携带Bearer Token访问上述接口时，始终返回401状态码。请问哪里配置错误了？

1. 默认认证方案不匹配 #

你在AddAuthentication中指定默认方案为JwtBearerDefaults.AuthenticationScheme，但实际添加的JwtBearer认证方案名称是"FA"，导致认证流程没有使用你配置的"FA"规则验证Token。修改默认方案为"FA"即可：

builder.Services.AddAuthentication("FA") // 将默认方案改为自定义的"FA"
    .AddJwtBearer("FA", options =>
    {
        options.SaveToken = true;
        options.TokenValidationParameters = new TokenValidationParameters
        {
            ValidateIssuer = true,
            ValidateAudience = false,
            ValidateLifetime = true,
            ValidateIssuerSigningKey = true,
            ValidIssuer = builder.Configuration.GetValue<string>("Jwt:Issuer"),
            IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(builder.Configuration.GetValue<string>("Jwt:Key")))
        };
    });

2. 冗余的授权配置 #

你两次调用builder.Services.AddAuthorization，且自定义策略中的policy.Build()是多余的（AuthorizationPolicyBuilder为链式调用，不需要单独调用该方法）。可简化为单一授权配置：

// 保留一个AddAuthorization调用即可
builder.Services.AddAuthorization(options =>
{
    options.AddPolicy("FA", policy =>
    {
        policy.AddAuthenticationSchemes("FA")
              .RequireAuthenticatedUser();
    });
});

3. FusionAuth Token核心配置校验 #

• Issuer一致性：确认Jwt:Issuer配置值与FusionAuth应用的Issuer完全一致（通常是FusionAuth的域名地址）；
• 签名密钥匹配：如果FusionAuth使用对称密钥，确保Jwt:Key与应用配置中的JWT签名密钥完全相同；若使用非对称密钥（如RS256），需替换SymmetricSecurityKey为从FusionAuth获取的公钥构建的RsaSecurityKey；
• Token格式与有效期：检查Postman中Authorization头格式是否为Bearer <完整JWT>，同时通过JWT解码工具查看exp字段确认Token未过期。

4. 启用调试日志定位问题 #

在appsettings.Development.json中添加日志配置，查看详细认证失败原因：

{
  "Logging": {
    "LogLevel": {
      "Microsoft.AspNetCore.Authentication": "Debug"
    }
  }
}

运行API后，控制台会输出认证流程的详细日志，可直接定位如签名验证失败、Issuer不匹配等具体问题。

内容的提问来源于stack exchange，提问作者Code Ratchet