A very common question is: “my Web API returns a 401. Why?”

The easiest way to find out, is to enable tracing in IdentityModel. Add the following code snippet to your web.config:

<system.diagnostics>

  <trace autoflush=“true“ />

  <sources>

    <source name=“Thinktecture.IdentityModel“

            switchValue=“Verbose,ActivityTracing“>

      <listeners>

        <add name=“ThinktectureListener“ />

      </listeners>

    </source>

  </sources>

  <!– worker process account needs write access  –>

  <sharedListeners>

    <add name=“ThinktectureListener“

         type=“System.Diagnostics.XmlWriterTraceListener, …“

         initializeData=“C:\tracing\WebApiSecurity_idm.svclog“

         traceOutputOptions=“Callstack“>

      <filter type=“” />

    </add>

  </sharedListeners>

</system.diagnostics>

Detailed authentication errors can now be found in the trace file (using SvcTraceViewer from the SDK), e.g.:

HTH