Azure AD B2C with AAD SignIn user journey is expecting wrong issuer

Question

I have setup the AAD Sign In within B2C following the instructions in this documentation article: https://learn.microsoft.com/en-us/azure/active-directory-b2c/active-directory-b2c-setup-aad-custom?tabs=applications

The process fails when AAD redirects to the response endpoint on B2C and then being redirected to https://jwt.ms with the follwing message: AADB2C90238:
The provided id_token does not contain a valid issuer. Valid issuer values: 'https://sts.windows.net/<aad-tenant-id>/<b2c-tenant-id>/'. Please provide another token and try again.

Of course this will fail because the token originating from AAD issuer will only be https://sts.windows.net/<aad-tenant-id>

Why is B2C expecting the B2C tenant ID as part of the issuer from AAD?

Answer 1

Check if you have the validtokenissuerprefixes claim in your custom claims policy

See here for more information on this claim : https://learn.microsoft.com/en-us/azure/active-directory-b2c/active-directory-b2c-setup-commonaad-custom?tabs=applications#add-a-claims-provider

Duplicate information here : https://social.msdn.microsoft.com/Forums/en-US/db46c12d-abc9-4bff-86da-9c24a00232dc/azure-ad-b2c-with-aad-signin-user-journey-is-expecting-wrong-issuer?forum=WindowsAzureAD

One of the values were wrong for the prefixes.