APIM JWT Token Validation Policy Error on Issuer Key

Arslan Pervaiz 20

I am using APIM to validate JWT Tokens and here is my policy looks

<validate-jwt header-name="Authorization" failed-validation-httpcode="401" failed-validation-error-message="Unauthorized. Access token is missing or invalid.">
        <audience>68f3930e-0492-4642-8cd0-65d68a504dba</audience>
        <audience>7a20a24d-1bc7-4906-8dfc-c0e6dfd19d69</audience>
        <audience>ae901aaf-6bea-4e1b-902c-6851e4305b1b</audience>
        <audience>0d5b8f5e-4045-459c-99f1-a710ca8dd63e</audience>
        <audience>c37587ed-2974-4932-b87f-e51886ca378e</audience>
        <audience>2f96ac72-7887-4aa4-a02c-204288fe1ed8</audience>
        <audience>7c5dd291-edd7-4dc4-ad09-25ac006a0a42</audience>
    </audiences>
    <issuers>
        <issuer>https://login.microsoftonline.com/{TennatId}/v2.0/</issuer>
        <issuer>https://{Tennant}.b2clogin.com/38cf84e1-4cbb-4abb-8aa3-4c0f7107c585/v2.0/</issuer>
        <issuer>https://sts.windows.net/{TennatId}/</issuer>
    </issuers>
</validate-jwt>

I am specifying issuers so I can validate B2B and B2C JWT Tokens and also added Audience as well so it can validates the token generated by multiple applications. I am not specifying OpenId Config because there is explicit issuers are specified in my case.

I am getting this error

validate-jwt (-0.148 ms)
{
    "message": "JWT Validation Failed: IDX10500: Signature validation failed. No security keys were provided to validate the signature.."
}

I tried to specified the Issuer keys like this which I am getting this way
https://login.microsoftonline.com/{tenant_id}/discovery/keys?appid={client_id}
https://{Tennant}.b2clogin.com/{tennant}.onmicrosoft.com/B2C_1_si/discovery/v2.0/keys

I am retrieving multiple Kids and which I specified below but getting error on saving policy for "Not valid Base64 string"

 <issuer-signing-keys>
        <key>X5eXk4xyojNFum1kl2Ytv8dlNP4-c57dO6QGTVBwaNk</key>
        <key>Mr5-AUibfBii7Nd1jBebaxboXW0</key>
    </issuer-signing-keys>

Please suggest what I am doing wrong in my case.

Thanks

Accepted answer

Ben Gimblett 4,540 Reputation points Microsoft Employee

2023-07-10T10:59:05.7833333+00:00

I think you need to provide more to the validator ref the key element

In the example you pasted into your question you only provide the public key identifier (KID or ID) . Try also adding the "n" and "e" values (from the json returned from B2C keys URL)
Please sign in to rate this answer.

1 person found this answer helpful.
Arslan Pervaiz 20 Reputation points

2023-07-10T12:13:15.55+00:00

Thanks @Ben Gimblett

Here is my example Kid, n & e for B2C

{ "keys": [ {"kid":"X5eXk4xyojNFum1kl2Ytv8dlNP4-c57dO6QGTVBwaNk","nbf":1493763266,"use":"sig","kty":"RSA","e":"AQAB","n":"tVKUtcx_n9rt5afY_2WFNvU6PlFMggCatsZ3l4RjKxH0jgdLq6CScb0P3ZGXYbPzXvmmLiWZizpb-h0qup5jznOvOr-Dhw9908584BSgC83YacjWNqEK3urxhyE2jWjwRm2N95WGgb5mzE5XmZIvkvyXnn7X8dvgFPF5QwIngGsDG8LyHuJWlaDhr_EPLMW4wHvH0zZCuRMARIJmmqiMy3VD4ftq4nS5s8vJL0pVSrkuNojtokp84AtkADCDU_BUhrc2sIgfnvZ03koCQRoZmWiHu86SuJZYkDFstVTVSR0hiXudFlfQ2rOhPlpObmku68lXw-7V-P7jwrQRFfQVXw"} ] }

and this is for B2B

{ "kty": "RSA", "use": "sig", "kid": "-KI3Q9nNR7bRofxmeZoXqbHZGew", "x5t": "-KI3Q9nNR7bRofxmeZoXqbHZGew", "n": "tJL6Wr2JUsxLyNezPQh1J6zn6wSoDAhgRYSDkaMuEHy75VikiB8wg25WuR96gdMpookdlRvh7SnRvtjQN9b5m4zJCMpSRcJ5DuXl4mcd7Cg3Zp1C5-JmMq8J7m7OS9HpUQbA1yhtCHqP7XA4UnQI28J-TnGiAa3viPLlq0663Cq6hQw7jYo5yNjdJcV5-FS-xNV7UHR4zAMRruMUHxte1IZJzbJmxjKoEjJwDTtcd6DkI3yrkmYt8GdQmu0YBHTJSZiz-M10CY3LbvLzf-tbBNKQ_gfnGGKF7MvRCmPA_YF_APynrIG7p4vPDRXhpG3_CIt317NyvGoIwiv0At83kQ", "e": "AQAB", "x5c": [ "MIIDBTCCAe2gAwIBAgIQGQ6YG6NleJxJGDRAwAd/ZTANBgkqhkiG9w0BAQsFADAtMSswKQYDVQQDEyJhY2NvdW50cy5hY2Nlc3Njb250cm9sLndpbmRvd3MubmV0MB4XDTIyMTAwMjE4MDY0OVoXDTI3MTAwMjE4MDY0OVowLTErMCkGA1UEAxMiYWNjb3VudHMuYWNjZXNzY29udHJvbC53aW5kb3dzLm5ldDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALSS+lq9iVLMS8jXsz0IdSes5+sEqAwIYEWEg5GjLhB8u+VYpIgfMINuVrkfeoHTKaKJHZUb4e0p0b7Y0DfW+ZuMyQjKUkXCeQ7l5eJnHewoN2adQufiZjKvCe5uzkvR6VEGwNcobQh6j+1wOFJ0CNvCfk5xogGt74jy5atOutwquoUMO42KOcjY3SXFefhUvsTVe1B0eMwDEa7jFB8bXtSGSc2yZsYyqBIycA07XHeg5CN8q5JmLfBnUJrtGAR0yUmYs/jNdAmNy27y83/rWwTSkP4H5xhihezL0QpjwP2BfwD8p6yBu6eLzw0V4aRt/wiLd9ezcrxqCMIr9ALfN5ECAwEAAaMhMB8wHQYDVR0OBBYEFJcSH+6Eaqucndn9DDu7Pym7OA8rMA0GCSqGSIb3DQEBCwUAA4IBAQADKkY0PIyslgWGmRDKpp/5PqzzM9+TNDhXzk6pw8aESWoLPJo90RgTJVf8uIj3YSic89m4ftZdmGFXwHcFC91aFe3PiDgCiteDkeH8KrrpZSve1pcM4SNjxwwmIKlJdrbcaJfWRsSoGFjzbFgOecISiVaJ9ZWpb89/+BeAz1Zpmu8DSyY22dG/K6ZDx5qNFg8pehdOUYY24oMamd4J2u2lUgkCKGBZMQgBZFwk+q7H86B/byGuTDEizLjGPTY/sMms1FAX55xBydxrADAer/pKrOF1v7Dq9C1Z9QVcm5D9G4DcenyWUdMyK43NXbVQLPxLOng51KO9icp2j4U7pwHP" ], "issuer": "https://login.microsoftonline.com/{Tennant}/v2.0" },

How should I pass this in Issuer Keys

I tried this way but it still gives error for base64 string

<issuer-signing-keys> <key>X5eXk4xyojNFum1kl2Ytv8dlNP4-c57dO6QGTVBwaNk n="tVKUtcx_n9rt5afY_2WFNvU6PlFMggCatsZ3l4RjKxH0jgdLq6CScb0P3ZGXYbPzXvmmLiWZizpb-h0qup5jznOvOr-Dhw9908584BSgC83YacjWNqEK3urxhyE2jWjwRm2N95WGgb5mzE5XmZIvkvyXnn7X8dvgFPF5QwIngGsDG8LyHuJWlaDhr_EPLMW4wHvH0zZCuRMARIJmmqiMy3VD4ftq4nS5s8vJL0pVSrkuNojtokp84AtkADCDU_BUhrc2sIgfnvZ03koCQRoZmWiHu86SuJZYkDFstVTVSR0hiXudFlfQ2rOhPlpObmku68lXw-7V-P7jwrQRFfQVXw" e="AQAB"</key> <key>-KI3Q9nNR7bRofxmeZoXqbHZGew n="tJL6Wr2JUsxLyNezPQh1J6zn6wSoDAhgRYSDkaMuEHy75VikiB8wg25WuR96gdMpookdlRvh7SnRvtjQN9b5m4zJCMpSRcJ5DuXl4mcd7Cg3Zp1C5-JmMq8J7m7OS9HpUQbA1yhtCHqP7XA4UnQI28J-TnGiAa3viPLlq0663Cq6hQw7jYo5yNjdJcV5-FS-xNV7UHR4zAMRruMUHxte1IZJzbJmxjKoEjJwDTtcd6DkI3yrkmYt8GdQmu0YBHTJSZiz-M10CY3LbvLzf-tbBNKQ_gfnGGKF7MvRCmPA_YF_APynrIG7p4vPDRXhpG3_CIt317NyvGoIwiv0At83kQ" e="AQAB"</key> </issuer-signing-keys>

Lastly I read somewhere these Issuer keys keeps changing and there is no certain time when these key will be updated so how I can make sure we always have valid issuer keys in JWT policy and validation works all the time.

Ben Gimblett 4,540 Reputation points Microsoft Employee

2023-07-10T13:53:16.4+00:00

The additional data for the key element is provided in the attributes as per the linked doc for the policy above

<key n="?" e="?" id="?" />

the jwt fields for B2C specify an RSA key (kty=RSA) and RSA keys are derived from the "n" and "e" fields

I would think you'd need "id" ,"n" and "e" values expressed as attributes

(I've not actually tried this)

Ben Gimblett 4,540 Reputation points Microsoft Employee

2023-07-10T13:58:30.18+00:00

To the other part of the question, yes, that's correct and unfortunately it adds complexity

in the ideal world you use the values provided in the open-id endpoint, but as you pointed out, you cant

I think you'd need custom c# script in your policy to get the keys (from the b2c key url) and en-cache them for 24hours

The team provide some examples here that can be useful to get started with

Arslan Pervaiz 20 Reputation points

2023-07-10T15:13:32.7866667+00:00

Thanks @Ben Gimblett for your reply

Even specifying key in id="" along with n="' e="" it still errors out on base 64 string.

I am not sure should I do this or not @(Convert.ToBase64String(Encoding.UTF8.GetBytes("key")))

Ben Gimblett 4,540 Reputation points Microsoft Employee

2023-07-10T15:25:08.18+00:00

Can you show me your new xml snip for the key, in issuer-signing-keys? paste in comment below?

Arslan Pervaiz 20 Reputation points

2023-07-10T15:35:02.4933333+00:00

<issuer-signing-keys> <key> id="X5eXk4xyojNFum1kl2Ytv8dlNP4-c57dO6QGTVBwaNk" n="tVKUtcx_n9rt5afY_2WFNvU6PlFMggCatsZ3l4RjKxH0jgdLq6CScb0P3ZGXYbPzXvmmLiWZizpb-h0qup5jznOvOr-Dhw9908584BSgC83YacjWNqEK3urxhyE2jWjwRm2N95WGgb5mzE5XmZIvkvyXnn7X8dvgFPF5QwIngGsDG8LyHuJWlaDhr_EPLMW4wHvH0zZCuRMARIJmmqiMy3VD4ftq4nS5s8vJL0pVSrkuNojtokp84AtkADCDU_BUhrc2sIgfnvZ03koCQRoZmWiHu86SuJZYkDFstVTVSR0hiXudFlfQ2rOhPlpObmku68lXw-7V-P7jwrQRFfQVXw" e="AQAB"</key> <key> id="-KI3Q9nNR7bRofxmeZoXqbHZGew" n="tJL6Wr2JUsxLyNezPQh1J6zn6wSoDAhgRYSDkaMuEHy75VikiB8wg25WuR96gdMpookdlRvh7SnRvtjQN9b5m4zJCMpSRcJ5DuXl4mcd7Cg3Zp1C5-JmMq8J7m7OS9HpUQbA1yhtCHqP7XA4UnQI28J-TnGiAa3viPLlq0663Cq6hQw7jYo5yNjdJcV5-FS-xNV7UHR4zAMRruMUHxte1IZJzbJmxjKoEjJwDTtcd6DkI3yrkmYt8GdQmu0YBHTJSZiz-M10CY3LbvLzf-tbBNKQ_gfnGGKF7MvRCmPA_YF_APynrIG7p4vPDRXhpG3_CIt317NyvGoIwiv0At83kQ" e="AQAB"</key> </issuer-signing-keys>

Ben Gimblett 4,540 Reputation points Microsoft Employee

2023-07-10T15:49:03.2566667+00:00

ah, ok
your xml is not quite correct

I think you'd need something like this

<key id="X5eXk4xyojNFum1kl2Ytv8dlNP4-c57dO6QGTVBwaNk" n="tVKUtcx_n9rt5afY_2WFNvU6PlFMggCatsZ3l4RjKxH0jgdLq6CScb0P3ZGXYbPzXvmmLiWZizpb-h0qup5jznOvOr-Dhw9908584BSgC83YacjWNqEK3urxhyE2jWjwRm2N95WGgb5mzE5XmZIvkvyXnn7X8dvgFPF5QwIngGsDG8LyHuJWlaDhr_EPLMW4wHvH0zZCuRMARIJmmqiMy3VD4ftq4nS5s8vJL0pVSrkuNojtokp84AtkADCDU_BUhrc2sIgfnvZ03koCQRoZmWiHu86SuJZYkDFstVTVSR0hiXudFlfQ2rOhPlpObmku68lXw-7V-P7jwrQRFfQVXw" e="AQAB"/>

The element contains only attributes - not a value

Ben Gimblett 4,540 Reputation points Microsoft Employee

2023-07-10T15:49:33.83+00:00

again, i did not get time to "try" this - but the docs are reasonably clear and this is what i think they are describing . Also, I dont think you should need to explicitly encode the values here.

Ben Gimblett 4,540 Reputation points Microsoft Employee

2023-07-10T19:27:23.0233333+00:00

To close the loop I just got time to actually try this, redacting values this config worked for me

<validate-jwt header-name="Authorization" failed-validation-httpcode="401" failed-validation-error-message="Unauthorized" require-expiration-time="true" require-scheme="Bearer" require-signed-tokens="true" clock-skew="0"> <issuer-signing-keys> <key id="X5eXk4xyojNFu..." n="tVKUtcx_n9rt5afY..." e="AQAB" /> </issuer-signing-keys> <audiences> <audience>58b248a7-2dd8-4e83-977d-...</audience> </audiences> <issuers> <issuer>https://{my tenant}.b2clogin.com/8d956e99.../v2.0/</issuer> </issuers> </validate-jwt>

Ben Gimblett 4,540 Reputation points Microsoft Employee

2023-07-10T19:29:25.1733333+00:00

as per previous comment - would now need to add custom c# script to pull these values from the b2c endpoint and cache (~24hours should be fine) - can use the in-memory cache provider in APIM

the example git hub repo (linked in above comment) has a example to reach to a http endpoint and cache the result, which is close to what you need

Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

1 additional answer

MuthuKumaranMurugaachari-MSFT 22,381 Reputation points

2023-07-10T16:23:45.4166667+00:00
Arslan Pervaiz Thanks for posting your question in Microsoft Q&A. Based on the discussion, you are looking to specify issuer-signing-keys instead of specifying openid-config and got error message "Not valid Base64 string".

You would need to specify keys as Base64 encoded signing key and the sample value X5eXk4xyojNFum1kl2Ytv8dlNP4-c57dO6QGTVBwaNk is not base64 string according to online tools such as https://onlinebase64tools.com/validate-base64. In the policy snippet, you can convert the key string to base64 using <set-variable name="base64Key" value="@(Convert.ToBase64String(Encoding.UTF8.GetBytes("X5eXk4xyojNFum1kl2Ytv8dlNP4-c57dO6QGTVBwaNk")))" /> and use base64 string (validated it is base64 in the online tool) in that section like below:

<issuer-signing-keys> <key>@((string)context.Variables["base64Key"])</key> </issuer-signing-keys>

I see similar discussion in your SO thread and this should help in mitigating the above error. If you face any other issues or questions, let us know. Would be happy to answer.
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

APIM JWT Token Validation Policy Error on Issuer Key

1 additional answer

Your answer