When using a custom Azure ClaimsMappingPolicy can't sign in "This application is required to be configured with an application-specific signing key. "

Question

I have an MVC application in azure, and it signs in using Azure AD.

This works great. However in the Claims of the user, I want to include Employee Id.

There's a tutorial on this here which allows you to specify a custom ClaimsMappingPolicy and the example they have is actually including the Employee Id, which is perfect. It looks like this:

New-AzureADPolicy -Definition @('{"ClaimsMappingPolicy":{"Version":1,"IncludeBasicClaimSet":"true", "ClaimsSchema": [{"Source":"user","ID":"employeeid","SamlClaimType":"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/employeeid","JwtClaimType":"employeeid"},{"Source":"company","ID":"tenantcountry","SamlClaimType":"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/country","JwtClaimType":"country"}]}}') -DisplayName "IncludeEmployeeIdInClaimsPolicy" -Type "ClaimsMappingPolicy"

However when I configure this mapping policy, I can no longer sign in, because I get this error:

This application is required to be configured with an application-specific signing key. It is either not configured with one, or the key has expired or is not yet valid.

My guess is that I have somehow overridden the default settings, or messed something up in my claims mapping policy.

I don't know what it could be though, as I haven't changed anything else.

My code for authentication is:

Program.cs

// Azure AD
builder.Services.AddAuthentication(OpenIdConnectDefaults.AuthenticationScheme)
    .AddMicrosoftIdentityWebApp(builder.Configuration.GetSection("AzureAd"));

and

builder.Services.AddControllersWithViews(options =>
{
    var policy = new AuthorizationPolicyBuilder()
        .RequireAuthenticatedUser()
        .Build();

    options.Filters.Add(new AuthorizeFilter(policy));
});

Nothing fancy.

What could I be missing that is generating this error?

ShwetaM · Answer

When user modify the token contents through claims-mapping policies, then application must know that tokens have been modified by the user themselves rather than attackers.

Your application's manifest need to update to enable the acceptMappedClaims to true in the Azure portal.

Below are the steps to create policy and to update application's manifest:

1.First, you need to connect to Azure AD to sign to your tenant.

Connect-AzureAD

2.Use below cmdlet to create New Azure AD Policy to add Basic Claims "employeeId".

New-AzureADPolicy -Definition @('{"ClaimsMappingPolicy": {"Version": 1,"IncludeBasicClaimSet": "true","ClaimsSchema":[
{"Source": "user","ID": "employeeId","JwtClaimType": "employeeId"}]}}') -DisplayName "BasicClaimJob-employeeId" -Type "ClaimsMappingPolicy"

3.Run the following command to see your newly created policy and copy the policy ObjectId,

Get-AzureADPolicy

4.Then,assign the policy to your service principal. You can get the ObjectId of your service principal from Enterprise applications blade

Add-AzureADServicePrincipalPolicy -Id  -RefObjectId

Once policy has successfully assigned, then enable the AcceptMappedClaims to true in the App Manifest as shown above.

Now you should see Basic Claims "employeeId" appears in JWT token.

When using a custom Azure ClaimsMappingPolicy can't sign in "This application is required to be configured with an application-specific signing key. "

1 Answers