Web API and Mobile API with Bearer-Token - asp.net

Question

We are building Server for Web Api and Mobile Api using Bearer-Token with OWIN.
The requirements to validate are different between these two.
This is the Owin Configuration:
public void Configuration(IAppBuilder app)
{
app.MapSignalR();
ConfigureOAuth(app);
}
public void ConfigureOAuth(IAppBuilder app)
{
OAuthAuthorizationServerOptions OAuthServerOptions = new OAuthAuthorizationServerOptions()
{
TokenEndpointPath = new PathString("/Api/Token"),
Provider = new ApplicationOAuthProvider(),
// RefreshTokenProvider = new ApplicationRefreshTokenProvider(),
AccessTokenExpireTimeSpan = TimeSpan.FromMinutes(8),
AllowInsecureHttp = true,
};
// Enable the application to use bearer tokens to authenticate users
app.UseOAuthBearerTokens(OAuthServerOptions);
OAuthAuthorizationServerOptions mobOAuthServerOptions = new OAuthAuthorizationServerOptions()
{
TokenEndpointPath = new PathString("/Mobile/Token"),
Provider = new MobileOAuthProvider(),
AccessTokenExpireTimeSpan = TimeSpan.FromMinutes(20),
AllowInsecureHttp = true,
};
// Enable the application to use bearer tokens to authenticate users
app.UseOAuthBearerTokens(mobOAuthServerOptions);
}
This is the routing:
public class WebApiConfig
{
public static void Register(HttpConfiguration config)
{
config.Routes.MapHttpRoute(
name: "DefaultApi",
routeTemplate: "Api/{controller}/{id}",
defaults: new { id = RouteParameter.Optional }
);
config.Routes.MapHttpRoute(
name: "MobileApi",
routeTemplate: "Mobile/{controller}/{id}",
defaults: new { id = RouteParameter.Optional }
);
// Ignore any authentication that happens before the request reaches the Web Api pipeline, either by IIS or OWIN middleware.
// That way to restrict Web Api to authenticate only using bearer tokens.
config.SuppressDefaultHostAuthentication();
// enable authentication using bearer tokens.
config.Filters.Add(new HostAuthenticationFilter(OAuthDefaults.AuthenticationType));
// configuration.Filters.Add(new TokenValidationAttribute());
}
}
Controller for API:
[Authorize]
public class EmployeeLeaveBalanceController : ApiBaseController
{
public EmployeeLeaveBalanceController()
: base()
{ }
[System.Web.Http.HttpGet]
public ApiResult GetLeaveBalance([FromUri] string payrollName, [FromUri] string employeeNumber)
{
try
{
SetContext(null);
ApiResult result = ValidateParameter(payrollName);
if (result != null)
return result;
EmployeeLeaveBalanceModel model = new EmployeeLeaveBalanceModel();
return model.GetLeaveBalance(payrollName, employeeNumber);
}
catch //(Exception)
{
return new ApiResult().SetMessage(ApiResultMessage.UnexceptedError);
}
}
private ApiResult ValidateParameter(string payrollName)
{
bool isValid = UploadHelper.GetPayroll(payrollName) != null;
return (!isValid)
? new ApiResult().SetMessage(ApiResultMessage.InvalidParameter)
: null;
}
}
For Mobile Api
[Authorize]
public class UserController : MobileBaseController
{
#region Get
[System.Web.Http.HttpGet]
public UserMdo Get()
{
try
{
SetContext();
UserModel model = new UserModel();
return model.GetUser(ApplicationContext.UserId);
}
catch(Exception)
{
throw;
// return new MobileResult().SetError(1000, ex.Message);
}
}
#endregion
}
However, I always get Unauthorized access when accessing Mobile Controller.
And Api Controller stopped working as well.
Did I miss anything? How do the controllers know that the bearer-token belongs to Web Api or Mobile Api? I think this is the problem.
This code to get the token and use it for authentication as well