How to validate Token from personal Microsoft Account?

Question

I created a API that I try to protect with AAD. It's already working for Accounts from my organization and Accounts from other organizations but not for personal Microsoft Accounts.

I already tryed different Endpoints but I think the common Endpoint should be the correct Endpoint if I want any Account to be able to sign in.

This is how my API Startup looks:

            services.AddAuthentication(o =>
            {
               o.DefaultScheme = JwtBearerDefaults.AuthenticationScheme;
            })
            .AddJwtBearer(o =>
            {
                o.Authority = "https://login.microsoftonline.com/common";
                o.TokenValidationParameters = new Microsoft.IdentityModel.Tokens.TokenValidationParameters
                {
                    // Both App ID URI and client id are valid audiences in the access token
                    ValidAudiences = new List<string>
                    {
                        "APP ID",
                    },
                    ValidateIssuer = false,
               };
            });

And this is how I get the accesstoken at javascript:

    var applicationConfig = { //Cloudlist API via TestApp
        clientID: "APP ID",        
        authority: "https://login.microsoftonline.com/common",
        graphScopes: ["https://hsde.onmicrosoft.com/APP ID/User"]
    };
    var myMSALObj = new Msal.UserAgentApplication(applicationConfig.clientID, 
    applicationConfig.authority, null, { storeAuthStateInCookie: true, 
    cacheLocation: "localStorage" });

        myMSALObj.loginPopup(applicationConfig.graphScopes).then(function (idToken) { 
            myMSALObj.acquireTokenSilent(applicationConfig.graphScopes).then(function (accessToken) {
                callAPI(accessToken);;
            });
        }, function (error) {
                console.log(error);
        });

When I sign in with a personal Microsoft Account and use the accessToken to call the API I get a 401 Unauthorized Error. The response header says: www-authenticate: Bearer error="invalid_token", error_description="The signature key was not found"

Is there anything I have to do differently when signing in with a personal Microsoft Account ?

Have you tried using a tool like calebb.net to inspect your token? Some values might not be set properly. If you know what you are expecting to see in there this might help you. — Simon Bourdeau
I used jwt.io to inspect the token, I couldn't find anything that would make the token invalid. The aud is the same as for accounts from a organization. The kid is different but I'm not sure if that is causing the validation to fail. — ElBiasto

Fabricio Rojas Fabricio Rojas · Accepted Answer · 2019-05-16T20:10:00

First, get a token and try to decoded in jwt.io just to check if audience id is the same that you are using in you web api.

How to validate Token from personal Microsoft Account?

1 Answers