Question 105992 in Azure Question posted in
The official documentation to get you started can be found here.

"401 Unauthorized : The audience is invalid" Error with Azure AAD for .Net Core APIs

Azure AD by default generates Application URI in below format.

api://<<Client_Id>>

but When you change Application URI with "https://xyz.onmicrosoft.com/<<Client_Id>>" and the token generated using Auth Code Grant or Client Credential flow, if passed to API for Authorization, you will get below error.

WWW-Authenticate: Bearer error="invalid_token", error_description="The audience ‘https://xyz.onmicrosoft.com/<<Client_Id>>’ is invalid"

Tags:

2

Answers


  1. Chosen as BEST ANSWER
    0

    To solve this, AppSettings should be added as mentioned below,

      "AzureAd": {
    "Instance": "https://login.microsoftonline.com/",
    "Domain": "xyz.onmicrosoft.com",
    "TenantId": <<Tenant_Id>>,
    "ClientId": <<Client_Id>>,
    **"Audience": "https://xyz.onmicrosoft.com/<<Client_Id>>"**
  }

    Note: If you are using default URI then Audience is not required but with custom Application URI, Audience needs to be added.


  2. 0

    In my application config file I had to set Audience to Application ID URI (api://myapp.com) and when fetching a token in Insomnia resource had to be set TO the same Application ID URI

    Login or Signup to reply.
Please signup or login to give your own answer.

Back To Top
Search