Azure: How to retrieve issuer-signing-key for validate-jwt policy?

Question

I'm working in Azure, where our Web App calls the APIM with the request, and then the APIM calls the WebApi to fulfill the request.

We're hitting a 500 error when we try to call one of the APIs set up, and when drilling down to the error in the browser (below is "Error message") (Inspect -> Network), it shows the error message coming from a validate-jwt policy set up for the apim (a product-public.policy.xml):

<policies>
  <inbound>
    <base />
    <validate-jwt header-name="Authorization" failed-validation-httpcode="401" failed-validation-error-message="Error message" require-expiration-time="true" require-scheme="Bearer" require-signed-tokens="true">
      <openid-config url="{{validauthorityissuer}}/.well-known/openid-configuration" />
      <issuer-signing-keys>
        <key>Base64 Encoded Key</key>
      </issuer-signing-keys>
      <audiences>
        <audience>{{WebAppId}}</audience>
      </audiences>
      <issuers>
        <issuer>{{validauthorityissuer}}</issuer>
      </issuers>
    </validate-jwt>
  </inbound>

At first glance it looks like the issuer-signing-key is the problem, as it looks to be just a placeholder string.

To confirm it may be this causing the problem, I did a test in APIM, and got the following message: { "code": "401", "type": "AAD Authorization", "message": "No token provided to access the resource.", "developerMessage": "Missing or badly formatted access token", "moreInfo": null }

This leads me to believe even more that the problem is the issuer-signing-keys.

My question is, where do I obtain the issuer-signing-key? Haven't been able to find much help online and through documentation.

Second question would be, assuming I get the key, would I have to convert it to base64, then paste it where it currently says "Base64 Encoded Key"?

Ali Bhujwala Ali Bhujwala · Accepted Answer · 2020-10-12T13:53:05

you can get your issuer-signing-keys from your openID endpoint. I don't believe you have to worry about this. If you provide APIM with open-id endpoint (as you are doing) APIM will do this automatically. AD Samples below confirm this. You should remove the issuer related blocks. I would still experiment/validate.

https://docs.microsoft.com/en-us/azure/api-management/api-management-access-restriction-policies#ValidateJWT

Azure: How to retrieve issuer-signing-key for validate-jwt policy?

1 Answers