Azure API Managment Not Able to Authorize with azure b2c: Signature Failed

1
votes

I have configured a backend application (api) and azure apim devportal (client app) in b2c. I have provided access to backend api from client app. I have used this to configure oauth authentication in azure api management.

I am using authorization code flow. For token validation, I have used inbound policy:

 <validate-jwt header-name="Authorization" failed-validation-httpcode="401" failed-validation-error-message="Unauthorized" require-expiration-time="true" require-scheme="Bearer" require-signed-tokens="true" clock-skew="0">
        <openid-config url="https://<domain>/tenantid/v2.0/.well-known/openid-configuration?p=signinsignup_policy" />
        <required-claims>
            <claim name="aud">
                <value><appid for backend app></value>
            </claim>
        </required-claims>
    </validate-jwt>

While trying from apim developer portal I am getting below error while using the token received:.

JWT Validation Failed: IDX10501: Signature validation failed. Unable to match keys

I have configured backend api application id as resource and user_impersonation as defaultscope. Decoding token I can see same backend appid as aud. I also tried using appid uri as resource but see same error.

Any help is appreciated.

1
azureazure-ad-b2cazure-api-management
Open ID config URL should have a link to keyset - jwks_uri. Make sure that "kid" claim in token you're getting contains value of one of the keys in that document. – Vitaliy Kurokhtin

1 Answers

0
votes

There are a couple of scenarios that can lead to this error. Did you check below threads

Azure AD B2C error - IDX10501: Signature validation failed

https://github.com/Azure-Samples/active-directory-dotnet-webapp-openidconnect-aspnetcore/issues/18

If above are not helped: I assume that you are using Custom Policies. While creating Signingkey and encryption you must follow the steps which are described at https://docs.microsoft.com/en-us/azure/active-directory-b2c/active-directory-b2c-get-started-custom.

If you skip or modify Key Type/ Key Usage while creating TokenSigning & TokenEncryption keys there is a chance to get that issue.

Below steps I tried while integrating B2C with API Management. And it is working as expected

HTH