Azure Function with Azure AD access token

0
votes

I'm building a set of custom Azure Functions (Java) to be accessed by iOS and Android native clients using essentially and Oauth2 authentication strategy.

I'm able to successfully acquire a bearer access token from https://login.microsoftonline.com/XXXXX-XXXXXXXXX/oauth2/v2.0/token, but when I present this token to my Azure Function and attempt to validate it in code, I receive the following error. I'm doing something similar to the example provided here when validating the bearer token: https://dev.to/425show/secure-apis-with-azure-functions-java-azure-ad-and-ms-graph-49p1

AADSTS50013: Assertion failed signature validation. [Reason - The provided signature value did not match the expected signature value., Thumbprint of key used by client: 'XXXXXXXXXXXXXXXXXXXXXXXXXX'

Documentation from Microsoft is absurdly hard to use for what should be such a standard use case. Any help would be greatly appreciated.

1
azureazure-active-directoryazure-functions
Use jwt.ms to parse your access token and provide screenshots. – Carl Zhao
Also, please provide the snippet for parameters used to validate AD access token. – user1672994
Hi, if the posted answer resolves your question, please mark it as the answer by clicking the check mark. Doing so helps others find answers to their questions. See: meta.stackexchange.com/questions/5234/… – Carl Zhao

1 Answers

0
votes

I have answered several similar questions before. The root cause is whether the access token used in the assertion is for the Microsoft Graph api resource or the web api resource. You can determine the issuer of the token by parsing the token to see the aud claim.

If you use this access token to call the Microsoft Graph api, then you only need to set the scope to: https://graph.microsoft.com/.default.

If you use the access token to call web api (this is the api you expose in the Azure portal), then you need to set the scope to: api://{your api application client id}/{scope name}.

Please note: You can only put one type of api resource in the scope.