Access Token Validation Fails

Sravan Kumar Mettu 40

{

    "error": "invalid_grant",

    "error_description": "The audience in ID Token [https://graph.microsoft.com] does not match the expected audience api://APP_ID_URI."

}

Sravan Kumar Mettu 40 Reputation points

2023-09-26T10:21:22.7433333+00:00

Thank you for the response. I followed your screenshots and able to add the scope and client to "api//APP_ID" but problem still exists. Also added scope level permissions to My API (using Expose API).

I am actually, establishing connectivity between GCP and Azure for Workload Identity Federation. As part of this, GCP STS service validates Azure access token using sts.windows.net/TENANT_ID service (configured in GCP), that's when it is failing..

When I decode Azure's access token, "aud" field has "https://graph.microsoft.com" value whereas GCP configured as "api://APP_ID" as part of allowed audience.

Appreciate any help in this regard. Thank you!
CarlZhao-MSFT 42,031 Reputation points

2023-09-27T02:32:15.1666667+00:00

Hi @Sravan Kumar Mettu

It seems that you need to obtain two access tokens, one for calling your custom web API and another for calling the graph API to obtain Azure resources. Have you implemented OBO flow for this?
CarlZhao-MSFT 42,031 Reputation points

2023-10-03T06:45:12.34+00:00

Hi @Sravan Kumar Mettu

Would you please provide us with an update on the status of your issue?
Sravan Kumar Mettu 40 Reputation points

2023-10-11T14:32:45.31+00:00

Hi Carl, Thank you so much for the solution.

Apologies for the delay. We have added following value to the scope in client request (body, URL encoded format) to resolve the issue.

api://<APP_ID>/.default

Regards,

Sravan

Accepted answer

CarlZhao-MSFT 42,031 Reputation points

2023-09-26T03:21:44.2133333+00:00

Hi @Sravan Kumar Mettu

If you are trying to call your custom Web API instead of the Graph API, then when requesting the /token endpoint you should change the value of scope to api://APP_ID, which will return the Web API access token.

Hope this helps.

If the reply is helpful, please click Accept Answer and kindly upvote it. If you have additional questions about this answer, please click Comment.
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Access Token Validation Fails

0 additional answers

Your answer