2

Well, my first problem is that ADFS 2016 don't generate KID header in JWT token and i need it to authenticate in my Identity Provider (Spring Security).

I resolved this problem getting the ID_TOKEN generated by ADFS, which have the KID as I expected. But using ID_TOKEN I got wrong AUD claim.

The AUD claim should be the CLIENTID of my ResourceServer but ADFS is generating AUD content with CLIENTID my own application (Client Application) and when I try to call my ResourceServer i got Access Denied because AUD claim is wrong.

Any tips to solve this problem ?

Ronaldo Lanhellas
  • 2,975
  • 5
  • 46
  • 92

1 Answers1

0

I had the same problem, I solved it adding an identifier with the correct name..

be careful because adfs use the first in the list and is an ordered list.

This solution could be used for application groups too.

Ex.

  • if you add Application1 and MyID, adfs use application 1 as aud
  • if you add MyID and Application1, adfs use application 1 as aud
  • if you add Application4, MyID and Alice, adfs use Alice as aud

hope this help

regards

Claudio

Claudio Corbetta
  • 1
  • 1