3

I have two Azure Daemon apps. App A and App B.

App B works as expected. I call the /oauth2/v2.0/token to the the access token. Then I decode the token and extract the roles.

App A does not.. when i decode and validate the token it says "Invalid Audience".

When i use jwt.ms to look at the token, the difference is App A is putting api:// in the aud portion.. and App B is not.

For example..

App A: { "aud":"api://3srlk3j..."}

App B: { "aud":"323f4lk2..."}

What is causing one to add api:// for one and not the other?

  • Most likely the app uri is not updated for App A and it is being used as the audience. Please check this from Azure App A and modify it accordingly. – Srinath Menon Oct 28 '21 at 02:38

1 Answers1

6

The value of audience is also controlled by the accesstokenacceptedversion in the manifest file. When you decode the token you can check if issuer has v1 or v2 endpoint

"iss": "https://login.microsoftonline.com/xxxxx/v2.0",

For example here I have v2 endpoint ,so accesstokenacceptedversion in manifest must be set to 2 which might be probably null or 1 by default.

"accessTokenAcceptedVersion": 2,

So please check the same for your web app A and set it accordingly .(Also check the same for web app B) and then try to generate token.

enter image description here

Also if above alone doesn’t solve the error,the problem might be the configuration data for the Web API. When we say the ClientId ,it is the value under the "expose an API" option where it says "Application ID URI Depending on how you request the access token, the audience of the token might be either the client id or Application ID URI of the API.

enter image description here

Here under expose an API , it has App ID Uri as api://xxxxx, same must be set as client id in the application app settings.

 "AzureAd": {
    "Instance": "https://login.microsoftonline.com/",
    "Domain": "myportal.onmicrosoft.com",
    "TenantId": "mytenant-guid",
    "ClientId": "api://xxxxx"
  },

So please check this match in both the applications(A and B) with their respective app ID URIs in their app registrations.

kavyaS
  • 8,026
  • 1
  • 7
  • 19
  • Thanks! I spent hours trying to figure this out. It was the acceptedTokenVersion attribute. –  Oct 28 '21 at 12:44
  • Made my day (well actually my week)! This issue was driving me crazy for a while now :S – hbertsch Feb 24 '23 at 12:45