authorize AzureAD access_token in .net 6 webapi getting invalid token signature

Question

authorize AzureAD access_token in .net 6 webapi getting invalid token signature

srinivas kolagani 1

I have added my angular application into azureAD and trying to get access_token and passing that token to webapi but getting unauthorized error. I have tried multiple ways. I am just accessing basic weatherforecast controller with authorize attribute

builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)  
    .AddJwtBearer(options =>  
    {  
        options.Authority = "https://login.microsoftonline.com/{tenant-id}";  
        options.Audience = "api://{client-id}";  
    });  

builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)  
  .AddMicrosoftIdentityWebApi(options =>  
  {  
      builder.Configuration.Bind("AzureAd", options);  
      options.Events = new JwtBearerEvents();

}, options => { builder.Configuration.Bind("AzureAd", options); });

Shweta Mathur 30,466 Reputation points Microsoft Employee Moderator

2022-12-06T06:59:55.993+00:00
Hi @srinivas kolagani ,

Thanks for reaching out.

Did you tried to decode the token you are getting using jwt.ms ? The value of audience in the token would be client id of the API only. In ASP.net , the minimal configuration you need to validate the token is:

services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme) .AddJwtBearer(o => { o.Authority = "https://login.microsoftonline.com/your-tenant-id"; o.Audience = "your-app-client-id"; }); app.UseAuthentication(); app.UseAuthorization();

Thanks,
Shweta
srinivas kolagani 1 Reputation point

2022-12-06T08:50:20.377+00:00
I have seen my access_token where scopes don't have the api scope and how to add scopes in access token

Can I set that scopes in azure portal or how to configure that ??

auth: { clientId: 'eb385b15-c0b2-4753-a437-679588e9814b', redirectUri: 'http://localhost:4200', authority: environment.authority, postLogoutRedirectUri: environment.redirectUrl, }, angular code
Shweta Mathur 30,466 Reputation points Microsoft Employee Moderator

2022-12-12T06:01:05.483+00:00

To acquires an access token with the corresponding scopes of API, scope need to configure as :

export const protectedResources = {
todoListApi: {
endpoint: "http://localhost:5000/api/todolist",
scopes: ["https://your-tenant-name.onmicrosoft.com/api/tasks.read"],
},

Reference : https://learn.microsoft.com/en-us/azure/active-directory-b2c/enable-authentication-angular-spa-app#add-the-app-settings

Hope this will help.

Thanks,
Shweta
Shweta Mathur 30,466 Reputation points Microsoft Employee Moderator

2022-12-21T08:44:56.293+00:00

Hi @srinivas kolagani ,

Just checking in to see if the below answer helped. If this answers your query, please don’t forget to click "Accept the answer" and Up-Vote for the same, which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.

Thanks,
Shweta
Shweta Mathur 30,466 Reputation points Microsoft Employee Moderator

2022-12-28T08:38:17.397+00:00

Hi @srinivas kolagani ,

Just checking in to see if the below answer helped. If this answers your query, please don’t forget to click "Accept the answer" and Up-Vote for the same, which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.

Thanks,
Shweta
srinivas kolagani 1 Reputation point

2023-01-10T04:18:36.067+00:00

Hi swetha,

Tp access the the token in web api we need audience claim which will be apiscope so how to add that in scopes

var loginRequest = { scopes: ['api://c97979df-eff5-4d85-b4f5/demoapi.scope','openid'] // optional Array<string> }; this.authService.loginPopup(loginRequest);

if I do my login like this I am able to access api but how to correct this and add as configuration and get the audience and aceess that

sorrry for delay in response

1 answer

Your answer

Shweta Mathur 30,466 Reputation points Microsoft Employee Moderator

2022-12-06T06:59:55.993+00:00

Hi @srinivas kolagani ,

Thanks for reaching out.

Did you tried to decode the token you are getting using jwt.ms ? The value of audience in the token would be client id of the API only. In ASP.net , the minimal configuration you need to validate the token is:

services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme) .AddJwtBearer(o => { o.Authority = "https://login.microsoftonline.com/your-tenant-id"; o.Audience = "your-app-client-id"; }); app.UseAuthentication(); app.UseAuthorization();

Thanks,
Shweta
srinivas kolagani 1 Reputation point

2022-12-06T08:50:20.377+00:00

I have seen my access_token where scopes don't have the api scope and how to add scopes in access token

Can I set that scopes in azure portal or how to configure that ??

auth: { clientId: 'eb385b15-c0b2-4753-a437-679588e9814b', redirectUri: 'http://localhost:4200', authority: environment.authority, postLogoutRedirectUri: environment.redirectUrl, }, angular code
Shweta Mathur 30,466 Reputation points Microsoft Employee Moderator

2022-12-12T06:01:05.483+00:00

To acquires an access token with the corresponding scopes of API, scope need to configure as :

export const protectedResources = {
todoListApi: {
endpoint: "http://localhost:5000/api/todolist",
scopes: ["https://your-tenant-name.onmicrosoft.com/api/tasks.read"],
},

Reference : https://learn.microsoft.com/en-us/azure/active-directory-b2c/enable-authentication-angular-spa-app#add-the-app-settings

Hope this will help.

Thanks,
Shweta
Shweta Mathur 30,466 Reputation points Microsoft Employee Moderator

2022-12-21T08:44:56.293+00:00

Hi @srinivas kolagani ,

Just checking in to see if the below answer helped. If this answers your query, please don’t forget to click "Accept the answer" and Up-Vote for the same, which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.

Thanks,
Shweta
Shweta Mathur 30,466 Reputation points Microsoft Employee Moderator

2022-12-28T08:38:17.397+00:00

Hi @srinivas kolagani ,

Just checking in to see if the below answer helped. If this answers your query, please don’t forget to click "Accept the answer" and Up-Vote for the same, which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.

Thanks,
Shweta
srinivas kolagani 1 Reputation point

2023-01-10T04:18:36.067+00:00

Hi swetha,

Tp access the the token in web api we need audience claim which will be apiscope so how to add that in scopes

var loginRequest = { scopes: ['api://c97979df-eff5-4d85-b4f5/demoapi.scope','openid'] // optional Array<string> }; this.authService.loginPopup(loginRequest);

if I do my login like this I am able to access api but how to correct this and add as configuration and get the audience and aceess that

sorrry for delay in response

Answer 1

Bruce (SqlWork.com) 85,281

In ad, under the application add api permissions

https://learn.microsoft.com/en-us/azure/active-directory/develop/quickstart-configure-app-access-web-apis

Be sure to include the scope defined with the permissions defined above in the angular msal login.

srinivas kolagani 1 Reputation point

2022-12-05T05:03:11.4+00:00

I have tried doing that still not working getting same unauthorized error i want to know did I made any mistake in the adding services

Bruce (SqlWork.com) 85,281

I use react and msal-react, but the server config is just:

               services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)  
                    .AddMicrosoftIdentityWebApi(o =>  
                    {  
                        config.Bind("AzureAd", o);  
                        o.TokenValidationParameters.NameClaimType = ClaimTypes.Name;   
                        o.Events = new JwtBearerEvents  
                        {  
                        };  
                    }, o =>  
                    {  
                        config.Bind("AzureAd", o);  
                    });