Can I use EnableTokenAcquisitionToCallDownstreamApi from non Web apps? #3560

rido-min · 2025-10-16T17:24:47Z

rido-min
Oct 16, 2025

I'd like to use IAuthorizationHeaderProvider in a Console Application.

When I configured a worker console app with Microsoft.Identity.Web:

dotnet new worker
dotnet add package Microsoft.Identity.Web

And configure the services with

var builder = Host.CreateApplicationBuilder(args);
builder.Services
        .AddMicrosoftIdentityWebApiAuthentication(builder.Configuration, "AzureAd")
        .EnableTokenAcquisitionToCallDownstreamApi()
        .AddInMemoryTokenCaches();
var host = builder.Build();
host.Run();

I got the next error when calling builder.Build()

System.AggregateException
  HResult=0x80131500
  Message=Some services are not able to be constructed (Error while validating the service descriptor 'ServiceType: Microsoft.AspNetCore.Authorization.Policy.AuthorizationPolicyCache Lifetime: Singleton ImplementationType: Microsoft.AspNetCore.Authorization.Policy.AuthorizationPolicyCache': Unable to resolve service for type 'Microsoft.AspNetCore.Routing.EndpointDataSource' while attempting to activate 'Microsoft.AspNetCore.Authorization.Policy.AuthorizationPolicyCache'.) (Error while validating the service descriptor 'ServiceType: Rido.BFLite.Core.IUserTokenClient Lifetime: Singleton ImplementationType: Rido.BFLite.Core.UserTokenClient': Cannot consume scoped service 'Microsoft.Identity.Abstractions.IAuthorizationHeaderProvider' from singleton 'Rido.BFLite.Core.IUserTokenClient'.)
  Source=Microsoft.Extensions.DependencyInjection
  StackTrace:
   at Microsoft.Extensions.DependencyInjection.ServiceProvider..ctor(ICollection`1 serviceDescriptors, ServiceProviderOptions options)
   at Microsoft.Extensions.DependencyInjection.ServiceCollectionContainerBuilderExtensions.BuildServiceProvider(IServiceCollection services, ServiceProviderOptions options)
   at Microsoft.Extensions.Hosting.HostApplicationBuilder.Build()
   at Program.<<Main>$>d__0.MoveNext() in C:\_code\Rido.BFLite\samples\ABSTokenServiceClient\Program.cs:line 19

  This exception was originally thrown at this call stack:
    Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteFactory.CreateArgumentCallSites(Microsoft.Extensions.DependencyInjection.ServiceLookup.ServiceIdentifier, System.Type, Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteChain, System.Reflection.ParameterInfo[], bool)
    Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteFactory.CreateConstructorCallSite(Microsoft.Extensions.DependencyInjection.ServiceLookup.ResultCache, Microsoft.Extensions.DependencyInjection.ServiceLookup.ServiceIdentifier, System.Type, Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteChain)
    Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteFactory.TryCreateExact(Microsoft.Extensions.DependencyInjection.ServiceDescriptor, Microsoft.Extensions.DependencyInjection.ServiceLookup.ServiceIdentifier, Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteChain, int)
    Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteFactory.GetCallSite(Microsoft.Extensions.DependencyInjection.ServiceDescriptor, Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteChain)
    Microsoft.Extensions.DependencyInjection.ServiceProvider.ValidateService(Microsoft.Extensions.DependencyInjection.ServiceDescriptor)

Inner Exception 1:
InvalidOperationException: Error while validating the service descriptor 'ServiceType: Microsoft.AspNetCore.Authorization.Policy.AuthorizationPolicyCache Lifetime: Singleton ImplementationType: Microsoft.AspNetCore.Authorization.Policy.AuthorizationPolicyCache': Unable to resolve service for type 'Microsoft.AspNetCore.Routing.EndpointDataSource' while attempting to activate 'Microsoft.AspNetCore.Authorization.Policy.AuthorizationPolicyCache'.

Inner Exception 2:
InvalidOperationException: Unable to resolve service for type 'Microsoft.AspNetCore.Routing.EndpointDataSource' while attempting to activate 'Microsoft.AspNetCore.Authorization.Policy.AuthorizationPolicyCache'.

What is weird is that I have this working in one project, and an exact copy of that project (and from a clean repro) fails.

So the question is "Can we use IAuthorizationHeaderProvider in console apps?"