Exception of type 'Microsoft.IdentityModel.Tokens.AudienceUriValidationFailedException

Question

Exception of type 'Microsoft.IdentityModel.Tokens.AudienceUriValidationFailedException

Hemant Ashok 15

I'm encountering an error: Exception of type 'Microsoft.IdentityModel.Tokens.AudienceUriValidationFailedException' when trying to access the API at https://<sharepoint domain>.sharepoint.com/sites/<site>/_api/siteiconmanager/getsitelogo?type=1. Although I can log in and perform operations via the web interface with the same user, the API call fails. I'm using the react MSAL library to generate the token.

 .acquireTokenSilent({
        scopes: ['https://<share point domain>.sharepoint.com/.default'],
        account: accounts[0]
      })

1 answer

Your answer

Answer 1

LeelaRajeshSayana-MSFT 17,766 Moderator

Hi @Hemant Ashok Greetings! Thank you for posting this question here.

You may be setting the scope wrong when getting the access token using the MSAL library. Referring to the document How to Acquire token for an API I could see that the format to apply scopes is as follows scopes: ["user.read"]. You can then extract the access token in the desired format for the API by following the below snippet.

const accessTokenRequest = {
        scopes: ["user.read"],
        account: accounts[0],
      };
      instance
        .acquireTokenSilent(accessTokenRequest)
        .then((accessTokenResponse) => {
          // Acquire token silent success
          let accessToken = accessTokenResponse.accessToken;
          // Call your API with token

If the above approach does not work and you are using Account credentials to get access token, please refer to a solution shared on a similar thread How to get SharePoint site logo using Graph? which provides an alternate approach of acquiring token using an API end point.

Hope this helps! Please let us know if you have any additional questions or need further assistance.

If the response helped, please do click Accept Answer and Yes for the answer provided. Doing so would help other community members with similar issue identify the solution. I highly appreciate your contribution to the community.

Hemant Ashok 15 Reputation points

2024-08-29T04:36:57.35+00:00

@LeelaRajeshSayana-MSFT Thanks for your reply. I implemented the changes you suggested, but I'm still encountering an issue. I can retrieve a list of SharePoint sites and logos from the default domain linked to the user's domain. However, I need to access SharePoint domains other than the home domain.

For instance, a user with the email xxx@<domainname>.onmicrosoft.com can access <domainname>.sharepoint.com, but the same user is unable to call the API other SharePoint domains they have access to.
LeelaRajeshSayana-MSFT 17,766 Reputation points Moderator

2024-08-30T23:03:05.63+00:00

Hi @Hemant Ashok Can you try getting the access token using the API end point provided in the thread How to get SharePoint site logo using Graph? and test if the user can access other domain sites with the generated token

Hemant Ashok 15

I have created the access token using the below code

 instance
      .acquireTokenSilent({
       scopes: ['https://XXX.sharepoint.com/.default'],
        account: accounts[0]
      })
      .then((response) => {
        setSharePointAccessToken(response.accessToken);
      })
      .catch((error) => {
        const errorData = error.response.data[0]
          ? error.response.data[0]
          : error.response.data;
        toast.error(errorData.message, {
          autoClose: 1000,
        });
      });

but still getting error **Access token validation failure. Invalid audience.
**
User's image

LeelaRajeshSayana-MSFT 17,766 Reputation points Moderator

2024-09-04T16:34:28.4266667+00:00

Hi @Hemant Ashok can you try setting the scope as follows and see if the token returned is valid event scopes: ["user.read"]
Hemant Ashok 15 Reputation points

2024-09-05T04:24:34.8266667+00:00

Yes I tried but getting similar issue. Do I need to give additional permission?
LeelaRajeshSayana-MSFT 17,766 Reputation points Moderator

2024-09-24T21:54:16.9466667+00:00

Hi @Hemant Ashok Let me know if you still need assistance with this issue.

Share via

Exception of type 'Microsoft.IdentityModel.Tokens.AudienceUriValidationFailedException

1 answer

Your answer