JWT ID token using different jwks uri which has appid parameter

Shiva Kiran 0 Reputation points
2024-05-17T20:31:35.1666667+00:00

JWT ID token generated in this Azure AD Application is using keys from "jwks_uri": "https://login.microsoftonline.com/{tenant_id}/discovery/keys?appid={client_id}" rather than using the keys from this link https://login.microsoftonline.com/{tenant_id}/v2.0/discovery/keys(i.e., this is the link provided in the openid metadata link in the application endpoints). Is there a way to make my application use public keys from standard link and not have extra appid parameter?

How is it affecting my application?

So we use AWS appsync. Appsync has this OIDC authorization method where it can auto validate the JWT token in the header of any request with the issuer URL. It basically adds the .well-known/openid-configuration to the end of the provided issuer_URL. In my case as the metadata document has the appid parameter at the end. it is not able to find the keys used in signature and is failing to validate the valid JWT id tokens. "

Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
19,947 questions
{count} votes