Problem with Oauth2 JWT in Webapi2

Question

Basically all code is working, I can generate my token, I can do everything, but I’m not able to validate the token.

My code is like this when I call the api. What happens is: I’m sending the request with the token, but it still doesn’t validate, the token is in the header but it can’t validate.

(I’ve already added the Claims, startup part and startup.auth is set up the same as the site, if necessary put the rest of the code.)

[Authorize(Roles ="user")]
[HttpGet]
[Route("api/testeToken")]
public HttpResponseMessage testeToken()
{
    var user = User.Identity;
    HttpResponseMessage responseMessage = new HttpResponseMessage()
    {
        Content = new StringContent("{\"message\":\"asdasd\", \"payload\":\"\",\"response\":\"2123\"}")
    };

    return responseMessage;
}

I’m wearing this one tutorial

Filterconfig.Cs :

public class FilterConfig
{
    public static void RegisterGlobalFilters(GlobalFilterCollection filters)
    {
        filters.Add(new ValidateUserRoles());
        filters.Add(new HandleErrorAttribute());
    }
}

public class ValidateUserRoles : FilterAttribute, IAuthorizationFilter
{
    public void OnAuthorization(AuthorizationContext filterContext)
    {
        if (filterContext.HttpContext.Request.IsAuthenticated)
        {
           //
        }

    }
}

Customoauthprovider.Cs :

public class CustomOAuthProvider : OAuthAuthorizationServerProvider
    {
        public override Task GrantResourceOwnerCredentials(OAuthGrantResourceOwnerCredentialsContext context)
        {
            //context.OwinContext.Response.Headers.Add("Access-Control-Allow-Origin", new[] { "*" });

            IdentityUser novo = new IdentityUser(context.UserName);

            var ticket = new AuthenticationTicket(SetClaimsIdentity(context, novo), new AuthenticationProperties());
            context.Validated(ticket);

            return Task.FromResult<object>(null);
        }

        public override Task ValidateClientAuthentication(OAuthValidateClientAuthenticationContext context)
        {
            context.Validated();
            return Task.FromResult<object>(null);
        }

        private static ClaimsIdentity SetClaimsIdentity(OAuthGrantResourceOwnerCredentialsContext context, IdentityUser user)
        {
            var identity = new ClaimsIdentity("JWT");
            identity.AddClaim(new Claim(ClaimTypes.Name, context.UserName));
            identity.AddClaim(new Claim("user", context.UserName));
            identity.AddClaim(new Claim(ClaimTypes.Role,"user"));

            return identity;
        }
    }

Customjwtformat.Cs :

public class CustomJwtFormat : ISecureDataFormat<AuthenticationTicket>
    {
        private static readonly byte[] _secret = TextEncodings.Base64Url.Decode(ConfigurationManager.AppSettings["secret"]);
        private readonly string _issuer;

        public CustomJwtFormat(string issuer)
        {
            _issuer = issuer;
        }

        public string Protect(AuthenticationTicket data)
        {
            if (data == null)
            {
                throw new ArgumentNullException(nameof(data));
            }

            var signingKey = new HmacSigningCredentials(_secret);
            var issued = data.Properties.IssuedUtc;
            var expires = data.Properties.ExpiresUtc;

            return new JwtSecurityTokenHandler().WriteToken(new JwtSecurityToken(_issuer, null, data.Identity.Claims, issued.Value.UtcDateTime, expires.Value.UtcDateTime, signingKey));
        }

        public AuthenticationTicket Unprotect(string protectedText)
        {
            throw new NotImplementedException();
        }
    }

Startup.Cs :

public partial class Startup
{
    public void Configuration(IAppBuilder app)
    {
        ConfigureOAuth(app);
    }
}

Startup.Auth.Cs :

public partial class Startup
{
    public void ConfigureOAuth(IAppBuilder app)
    {

        var issuer = ConfigurationManager.AppSettings["issuer"];
        var secret = TextEncodings.Base64Url.Decode(ConfigurationManager.AppSettings["secret"]);


        app.UseJwtBearerAuthentication(new JwtBearerAuthenticationOptions
        {
            AuthenticationMode = AuthenticationMode.Active,
            AllowedAudiences = new[] { "Any" },
            IssuerSecurityTokenProviders = new IIssuerSecurityTokenProvider[]
{
    new SymmetricKeyIssuerSecurityTokenProvider(issuer, secret)
}
        });


        app.UseOAuthAuthorizationServer(new OAuthAuthorizationServerOptions
        {
            AllowInsecureHttp = true,
            TokenEndpointPath = new PathString("/oauth2/token"),
            AccessTokenExpireTimeSpan = TimeSpan.FromMinutes(30),
            Provider = new CustomOAuthProvider(),
            AccessTokenFormat = new CustomJwtFormat(issuer)
        });
    }
}