Skip to main content

Making sense of Azure AD Endpoint and Token Versioning

"error=“invalid_token”, error_description=“The signature is invalid”" is the error which stared me in the face. I was trying to use an Azure AD access token to authenticate with a .NET Core Web API protected by Azure AD. I inspected the token in JWT tool and immediately it became apparent that Issuing Authority name was wrong. "iss":"https://sts.windows.net/<tenantId>", even though the token was requested from an Azure AD v2 endpoint. So what gives!

To understand what is happening, let's understand the history of Azure AD. AAD has undergone life cycle changes where it has moved from a v1 to v2 and re-branded itself as Microsoft Identity platform. As part of that the issuing authoring has changed from sts.windows.net to login.microsoftonline.com. As there were already many applications relying on AAD when this change was made, Microsoft decided to support both the versions. Now this is where AAD tries to be extra clever which is not apparent at first glance.

When you register an application in AAD, there is a manifest generated for it. It contains a key accessTokenAcceptedVersion whose value is set to null. This means this app accepts token issued in v1 format which contains the issuing authority as sts.windows.net. If your app requests for an access token for this resource (by specifying it in the Scope), the token will be issued in a v1 format even though the you are requesting it from a v2 endpoint! To get the token in a v2 format, change the accessTokenAcceptedVersion to 2.

Hopefully Microsoft changes the default behavior to return token based on the endpoint version you are requesting it from and not the accepted token version of the resource you are requesting it for.

Comments

Popular posts from this blog

Integrating React with SonarQube using Azure DevOps Pipelines

In the world of automation, code quality is of paramount importance. SonarQube and Azure DevOps are two tools which solve this problem in a continuous and automated way. They play well for a majority of languages and frameworks. However, to make the integration work for React applications still remains a challenge. In this post we will explore how we can integrate a React application to SonarQube using Azure DevOps pipelines to continuously build and assess code quality. Creating the React Application Let's start at the beginning. We will use npx to create a Typescript based React app. Why Typescript? I find it easier to work and more maintainable owing to its strongly-typed behavior. You can very well follow this guide for jsx based applications too. We will use the fantastic Create-React-App (CRA) tool to create a React application called ' sonar-azuredevops-app '. > npx create-react-app sonar-azuredevops-app --template typescript Once the project creation is done, we

Proud to be a Bihari?

After nearly an year, this December I had a chance to visit Bihar. My visits normally consist of resting in my home in Patna and occasional visits to my uncle's place. But this time it was different. I had to go to Gaya to attend my cousin sister's marriage ceremony. Stepping out of Patna made me question - Am I really proud to be a Bihari? Patna is like any other city in India, struggling with pollution, traffic jams, crime, etc. Being snuggled in my bed in Patna had made me forget the reality of what Bihar really is; after all its been nearly 10 years since I had traveled to any town outside of Patna in Bihar. So, the illusion was broken the moment my uncle's brand new Maruti A-Star moved out of outskirts of Patna, to what is supposedly the "National Highway". If you haven't guessed it already, its an apology of a road.

Centralized Configuration for .NET Core using Azure Cosmos DB and Narad

We are living in a micro services world. All these services are generally hosted in Docker container which are ephemeral. Moreover these service need to start themselves up, talk to each other, etc. All this needs configuration and there are many commercially available configuration providers like Spring Cloud Config Server, Consul etc. These are excellent tools which provide a lot more functionality than just storing configuration data. However all these have a weakness - they have a single point of failure - their storage mechanism be it a file system, database etc. There are ways to work around those but if you want a really simple place to store configuration values and at the same time make it highly available, with guaranteed global availability and millisecond reads, what can be a better tool than Azure Cosmos DB! So I set forth on this journey for ASP.NET Core projects to talk to Cosmos DB to retrieve their configuration data. For inspiration I looked at Steeltoe Con