Enable MVC in your MVC web application project, as done in the authorization server project and add Home controller. Here is the code of HomeController:

    [Authorize] 
      public IActionResult Index() 
      {    
        return View(); 
      }

Configure MVC web application on port 5002.

You can configure the MVC web application on port 5002 by updating the launchsettings.json file and adding the UseUri in the WebHostBuilder object in the Program class.

Update the port to 5002 in the following entry:

    "WebApp": { 
      "commandName": "Project", 
      "launchBrowser": true, 
      "launchUrl": "http://localhost:5002", 
      "environmentVariables": { 
        "ASPNETCORE_ENVIRONMENT": "Development" 
      } 
    }

Here is the code of the Program class:

        public static void Main(string[] args) 
        { 
            var host = new WebHostBuilder() 
              .UseKestrel() 
              .UseContentRoot(Directory.GetCurrentDirectory()) 
              .UseIISIntegration() 
              .UseUrls("http://localhost:5002") 
              .UseStartup<Startup>() 
              .Build(); 

            host.Run(); 
        } 
      } 
    }

Now build and run your web application through dotnet run. Once both the authorization server and MVC web application have started, and when you navigate to the MVC app at http://localhost:5002, you will be redirected to the authorization server login page:

Log in with any of the users specified previously in the authorization server implementation and the authorization will show the consent screen, which confirms if the user allows the client application to access its scope claims:

If you allow, it will send the token back to the MVC web application and the cookie middleware will store that in the browser's cookie store.

Now, let's modify our HomeController and add another method that we want to be accessible by the user having an admin role. Add the ManageSite method and its corresponding view in your MVC web application project:

    [Authorize(Roles = "admin")] 
      public IActionResult ManageSite() 
      {  
          return View(); 
      }

Now, if you run and access with scott, the page will be accessible. However, the other user richard does not have any admin role assigned, and in this case it will be redirected to the access denied page.