Microsoft Graph API access token's signature verification is failed

Question

I have a Angular 4 site that I’m trying to use Microsoft Graph implicit flow to authenticate users then use token to call our APIs at another endpoint, so I use msal.js to get the access token.

After I bring the access token to my API endpoint and try to valid it, the token cannot be valid. I got a SignatureVerificationFailedException.

My understanding is that the access token is for Microsoft Graph API, not for my APIs, so I cannot valid it. (I can use it to call Graph API without problem)

How can I get a access token(not id token) using msal.js that can be used for my APIs but not Microsoft Graph? Thanks!

The reason I'm sending access token instead of id token to the API endpoint is that I want to get the puid claim from the token, which is not available for id token.

Here is what I was trying to valid the access token I got from client which is using msal.js

const string authority = "https://login.microsoftonline.com/common";
const string audience = "https://graph.microsoft.com";

string issuer = null;
string stsDiscoveryEndpoint = $"{authority}/v2.0/.well-known/openid-configuration";
List<SecurityToken> signingTokens = null;

var configManager = new ConfigurationManager<OpenIdConnectConfiguration>(stsDiscoveryEndpoint);
var config = await configManager.GetConfigurationAsync();
issuer = config.Issuer;
signingTokens = config.SigningTokens.ToList();

var tokenHandler = new JwtSecurityTokenHandler();

var validationParameters = new TokenValidationParameters
{
    ValidAudience = audience,
    ValidIssuer = issuer,
    ValidateIssuer = false, 
    IssuerSigningTokens = signingTokens,
    CertificateValidator = X509CertificateValidator.None
};

try
{
    // Validate token.
    SecurityToken validatedToken = new JwtSecurityToken();
    var claimsPrincipal = tokenHandler.ValidateToken(jwtToken, validationParameters, out validatedToken);
    var claimsIdentity = claimsPrincipal.Identity as ClaimsIdentity;

    return ExtractAuthenticatedUserFromClaimsIdentity(claimsIdentity);
}
catch (SignatureVerificationFailedException)
{
    throw;
}

Thanks,

Shawn Tabrizi Shawn Tabrizi · Accepted Answer · 2017-06-23T04:15:42

If you want to get an access token for your API rather than the Microsoft Graph API, you must specify your API as the resource in the token request.

Make sure that:

Your Web API has configured OAuth2Permission Scopes. See here. Configuring a resource application to expose web APIs
Your Client Application has selected permissions to those exposed APIs. Configuring a client application to access web APIs
Finally, make sure you use your Web API's App ID URI or App ID GUID as the resource value in your token request.

Let me know if this helps!

Microsoft Graph API access token's signature verification is failed

1 Answers