oauth-2.0azure-active-directoryjwtauthorizationazure-entra-id

How do I solve audience (aud) invalid claim error for downstream api service?

Anyone have a luck in providing aud token different from the domain name of the api endpoint? My Blazor calls the asp.net app (api) and got the error:

enter image description here

It worked totally fine when I had api app Application id and Jwt's "aud" in a form of api://[GUID]/write.access

After I updated it to the domain name (need custom claims, which won't work without it) it stopped working throwing the error.

Where I updated the audience in Entra:

  1. Application Id URI of the api app on Expose Api page ![enter image description here

  2. Downstream Api config of my Blazor app enter image description here

I guess that should be enough. The only possible root cause that I have in mind is different domain names: api endpoint is https://someappname.azurewebsites.net/accounts, and from you can see on the screenshots attached it's different

Solution

  • You can set the expected aud claim value in JwtBearer like this:

            .AddJwtBearer(opt =>
        {
            opt.Authority = _configuration["openid:authority"];
            opt.Audience = "paymentapi";
            ...

    this should be what the API should expect to see in the received access token.

    I did write a blog post about this here: Troubleshooting JwtBearer authentication problems in ASP.NET Core