As it currently stands, we have an identity server that runs; however, we can run our client without any credentials and use our application. Before we add resources, clients, or users to identity server, the next step is to have it refuse us entry (because we haven't set any of these things up).
IdentityServer
Securing the API
In order to secure the API, we need to do just two things (neither of which requires IdentityServer – and one is already done for us!). The first is that we need to tell ASP.NET Core that we want to use authorization. In our startup file, we're already calling AddControllers. Because ASP.NET Core is now open source, we can simply look at what this does for us:
private static IMvcCoreBuilder...
