6

I am currently trying to implement Oauth2.0 to protect API using below documentation

https://learn.microsoft.com/en-us/azure/api-management/api-management-howto-protect-backend-with-aad

And currently using the DEMO CONFERENCE API provide by azure apim to test the implementation.

And currently receiving error during test in developer portal as :

"message": "JWT Validation Failed: Claim value mismatch: aud=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxx.."

Compared the token passed with the claim value by decoding it and its matching.

I have the jwt token validation policy as below 

<inbound>
        <base />
        <validate-jwt header-name="Authorization" failed-validation-httpcode="401" failed-validation-error-message="Unauthorized. Access token is missing or invalid." require-expiration-time="false" require-signed-tokens="false">
            <openid-config url="https://login.microsoftonline.com/xxxxxxxxx-07c8-xxxxx-xxxx-xxxxxxxxx/.well-known/openid-configuration" />
            <required-claims>
                <claim name="aud" match="all" separator="-">
                    <value>xxxxxxxx-xxxxx-489e-a26e-xxxxxxxx</value>
                </claim>
            </required-claims>
        </validate-jwt>
</inbound>
rachit
  • 63
  • 1
  • 3

1 Answers1

4

First, you need to validate your JWT token. Then when we register an application its getting registered with version V1 and Access token issuer comes with sts url and if we try to pass Access Token with V2 its failed V2 issuer is login.microsoft.com.

So fix is to go in manifest file "accessTokenAcceptedVersion": 2 for registered applications in AD. Refer to this issue.

Joey Cai
  • 18,968
  • 1
  • 20
  • 30
  • hi i changed the "accessTokenAcceptedVersion":2 for all the registered application but still i am seeing the error as "JWT Validation Failed: IDX10205: Issuer validation failed. Issuer: 'https://login.microsoftonline.com/xxxxxxxxxxxxxxxxx/v2.0'. Did not match: validationParameters.ValidIssuer: '' or validationParameters.ValidIssuers: 'https://sts.windows.net/xxxxxxxxxxxxxxxxx/'.." – rachit Aug 29 '19 at 11:04
  • 2
    Have you set `` in apim? – Joey Cai Aug 30 '19 at 08:37