Jwt token Issuer validation failed

SATYA PAVANKUMAR 40 Microsoft Employee

Our project involves a static website that uses ReactApp for the frontend and connects to APIM APIs through APIM Management integration with the static web app. We also implemented an authentication mechanism for the website using Azure AAD B2C that has Custom Policies for signup,signin,signout etc.,

We created app registration for static web app in B2C and set the "acceptedVersion" to 2 in the manifest file. On APIM, we use the "validate-Jwt" policy to verify the B2C token.

The token generation was success however its getting failed at APIM validation.

Issue:
IDX10205: Issuer validation failed. Issuer: 'https://identity.2.azurestaticapps.net/.auth'. Did not match: validationParameters.ValidIssuer: '' or validationParameters.ValidIssuers: 'https://identity.4.azurestaticapps.net/.auth'.

Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
JananiRamesh-MSFT 24,111 Reputation points

2024-03-15T08:22:06.7333333+00:00

@SATYA PAVANKUMAR @SATYA PAVANKUMAR Thanks for reaching out. The error message you are seeing indicates that the issuer of the token received by APIM does not match the expected issuer. The expected issuer is https://identity.4.azurestaticapps.net/.auth, but the actual issuer is https://identity.2.azurestaticapps.net/.auth.

To resolve this issue, you need verify the validate-jwt policy in APIM to include the correct issuer.

do let me know incase of further queries, I would be happy to assist you.
JananiRamesh-MSFT 24,111 Reputation points

2024-03-15T09:31:56.39+00:00

@SATYA PAVANKUMAR As discussed offline you confirmed that the issue is with the way of generating token from static web app and not in issuer.
SnehaAgrawal-MSFT 20,856 Reputation points

2024-03-18T07:49:13.19+00:00

@SATYA PAVANKUMAR Thanks for reaching here! As its mentioned in the documented -Configuring authentication in an Azure Static Web App by using Azure AD B2C

When the access token expires or the app session is invalidated, Azure Static Web App initiates a new authentication request and redirects users to Azure AD B2C.

If the Azure AD B2C SSO session is active, Azure AD B2C issues an access token without prompting users to sign in again. If the Azure AD B2C session expires or becomes invalid, users are prompted to sign in again.

Could you please check if its prompting to sign in?

Check if all the steps followed from here- https://learn.microsoft.com/en-us/azure/active-directory-b2c/configure-authentication-in-azure-static-app

Share via

Jwt token Issuer validation failed