Azure AD B2C Audience validation failed

user_169674 0
Viewed 326

I'm trying to authenticate to my B2C AD tenant on Azure AD B2C. I'm using OAuth 2.0 on aspnet .NET 6

If I request a new bearer token using Client Id

0fdd4f3b-xxxx-xxxx-xxxx-3f84bd9d02ax

I get back an aud value

https://mysite.onmicrosoft.com/0fdd4f3b-xxxx-xxxx-a438-3f84bd9d02ax

I'm using

builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddMicrosoftIdentityWebApi(builder.Configuration.GetSection("AzureAd"));

If I use 0fdd4f3b-xxxx-xxxx-a438-3f84bd9d02ax in my config, he tries to validate it by prefixing Client ID with api:// and the following exception:

IDX10214: Audience validation failed. Audiences: 'https://mysite.onmicrosoft.com/0fdd4f3b-xxxx-xxxx-a438-3f84bd9d02ax'. Did not match: validationParameters.ValidAudience: 'api://0fdd4f3b-xxxx-xxxx-a438-3f84bd9d02ax'

If I use https://mysite.onmicrosoft.com/0fdd4f3b-xxxx-xxxx-a438-3f84bd9d02ax in my config, he tries to validate it by prefixing Client ID with api:// and the following exception:

IDX10214: Audience validation failed. Audiences: 'https://mysite.onmicrosoft.com/0fdd4f3b-xxxx-xxxx-a438-3f84bd9d02ax'. Did not match: validationParameters.ValidAudience: 'api://https://mysite.onmicrosoft.com/0fdd4f3b-xxxx-xxxx-a438-3f84bd9d02ax'

Why is the value always prefixed with api:// ?

.net-6.0 azure-ad-b2c asp.net-core azure
1 Answers

Ok, apparently Stack Overflow was my rubber ducky.

If your Application ID URI does not start with api:// you'll have to make a manual change to the manifest of your application and switch to access tokens version 2.

Manifest link

Then change the value of accessTokenAcceptedVersion from null to 2

Now you can go back to your local application configuration and set the value of ClientId to the GUID only not including https://xxx.onmicrosoft.com/.

user_1696740
Related