Nsryjdtyk

I'm trying to use Identity Server 4 to protect my API. Now I have gone through all the documentation at http://docs.identityserver.io/en/release/quickstarts/1_client_credentials.html and I have set up a few successful demos. However, there is one thing that I am failing to understand.

For example, First, we need to define a client on the IS4 that looks like this:

new Client

{

    ClientId = "client",



    // no interactive user, use the clientid/secret for authentication

    AllowedGrantTypes = GrantTypes.ClientCredentials,



    // secret for authentication

    ClientSecrets =

    {

        new Secret("secret".Sha256())

    },



    // scopes that client has access to

    AllowedScopes = { "api1" }

}

Then on the API we protect it by adding the IdentityServer4.AccessTokenValidation package and adding configuration to startup.cs

services.AddMvcCore()

    .AddAuthorization()

    .AddJsonFormatters();



services.AddAuthentication("Bearer")

    .AddIdentityServerAuthentication(options =>

    {

        options.Authority = "http://localhost:5000";

        options.RequireHttpsMetadata = false;



        options.ApiName = "api1";

    });

And then finally we add app.UseAuthentication();

Now, this all works when ran, however, the part that I don't understand is where is the secret defined in the API. As you can see, the client clearly expects a secret and yet I don't define this secret anywhere on my API. I also don't define anywhere on the IS4 anything about my API to say that you are protecting the API from this URI or something along those lines.

So how does this actually works in terms of IS4 knowing about the API and authenticating its requests?

EDIT:

To clarify some confusion, yes there is a client that I opted out in code above and I see now that I shouldn't, and in there I provide a secret, but I'm still not understanding how does the IS4 knows to protect my specific API. What if the request came from www.somerandomapi.com? From what I"m reading it would work regardless. Based on what you wrote, it does make sense that the client is passing the secret, but nowhere in my code is the IS4 told which API to protect.