Stop validating audience for webapi application in Azure AD

user_1793353 0
Viewed 1138

I have an ASP.NET WEB API Core 3.1 application working with Azure AD. I use Microsoft.Identity.Web library. I set up it like this:

public void ConfigureServices(IServiceCollection services)
{
    Trace.TraceInformation("Configuring services");
    services.AddProtectedWebApi(Configuration, subscribeToJwtBearerMiddlewareDiagnosticsEvents: true
            )
        .AddProtectedWebApiCallsProtectedWebApi(Configuration)
        .AddInMemoryTokenCaches();
    services.AddAuthentication(AzureADDefaults.BearerAuthenticationScheme)
        .AddAzureADBearer(options => Configuration.Bind("AzureAd", options));
.......
}

My application is multi-tenant, so I need to cancel validating audience. Recently I've used the library as a separate project, so I could change it in its source code:

ValidateIssuer = false

but currently I use the library from nuget, so I can't simply change the source code to avoid validation of audience (issuer).

How should I configure the library to achieve it?

azure-active-directory asp.net-web-api
3 Answers

For a multitenant application, set ValidateIssuer to false. That means the application will validate the issuer. Refer to this article.

Validate the token issuer in the JwtBearerEvents.TokenValidated event. The issuer is sent in the "iss" claim.

It is possible to disable issuer validation, you could refer to the code as below:

public void Configure(string name, JwtBearerOptions options)
{
    options.Audience = AzureOptions.ClientId;

    options.TokenValidationParameters = new TokenValidationParameters{
        ValidateIssuer = false
    };
    options.Events = new JwtBearerEvents()
    {
        OnTokenValidated = (context) =>
        {
            if(!context.SecurityToken.Issuer.StartsWith("https://sts.windows.net/"))
                throw new SecurityTokenValidationException();
                return Task.FromResult(0);
        }
    };

    options.Authority = $"{AzureOptions.Instance}{AzureOptions.TenantId}";
}
user_85579990

I think you can Inject your own validation code to handle multitenant validation, instead of trying to disable the validation. something like 

services.Configure<JwtBearerOptions>(AzureADDefaults.JwtBearerAuthenticationScheme, options => {
options.Authority += "/v2.0";

// The web API accepts as audiences both the Client ID (options.Audience) and api://{ClientID}.
options.TokenValidationParameters.ValidAudiences = new []
{
 options.Audience,
 $"api://{options.Audience}"
};

// Instead of using the default validation (validating against a single tenant,
// as we do in line-of-business apps),
// we inject our own multitenant validation logic (which even accepts both v1 and v2 tokens).
options.TokenValidationParameters.IssuerValidator = AadIssuerValidator.GetIssuerValidator(options.Authority).Validate;; });

As per microsoft docs: https://docs.microsoft.com/en-us/azure/active-directory/develop/scenario-protected-web-api-app-configuration#code-initialization

user_134708940

By using Microsoft.Identity.Web library, ValidateIssuer can be set to false as shown below:

services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
.AddProtectedWebApi(options =>
{
    options.TokenValidationParameters.ValidateIssuer = false;
},options => { Configuration.Bind("AzureAd", options); });

The Access Token contains aud (Audience) and iss (Issuer) as two separate claims.

Audience is the intended recipient of the token. The audience is Application ID of the API assigned in the Azure portal and to stop validating audience is not recommended.

user_136851390
Related