Error: Invalid_token, Description: 'The signature is invalid' (Occurs during validation in Asp.net Core Web API against AAD 2.0)

WATERKAMP, OLIVER 111

I try to validate my access-token (which I received from the AAD-token-endpoint before) in my Asp.net Core Web API 3.1 against the AAD and I get following response from the server:

access-control-allow-credentials: true
access-control-allow-origin: https://localhost:4200
date: Mon, 02 Nov 2020 16:45:05 GMT
server: Microsoft-IIS/10.0
status: 401
www-authenticate: Bearer error="invalid_token", error_description="The signature is invalid"
x-powered-by: ASP.NET

I tried already many different validation implementations in my web-api, but nothing works...:-(
I really don't know why this signature is invalid even when I got this access-token from the token-endpoint.

I happy for any kind of help to solve this problem.

It's really urgent for me.

Thanks,
Oliver

JamesTran-MSFT 36,376 Reputation points Microsoft Employee

2020-11-02T22:31:43.563+00:00
@WATERKAMP, OLIVER
Thank you for the post!

-Are you able to provide any documentation that you followed to set up your Web API?
-Can you provide the token endpoint you're currently using?

V1: https://login.microsoftonline.com/<tenant id>/oauth2/token V2: https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token

I found some documentation that might help with your issue and will post them below.

Unauthorized token and The signature is invalid
OAuth 2.0 and OpenID Connect protocols on Microsoft identity platform

If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.
WATERKAMP, OLIVER 111 Reputation points

2020-11-03T00:53:01.227+00:00
hi @JamesTran-MSFT

thanks for trying to help me out :-)

I have not really a documentation, which shows exactly what I did.
But following video shows more or less 80% of my implementation-way: watch

I am using the client library MSAL.js (Version 2.0) (authorization_code flow) to authenticate my Angular SPA against AAD:
msal-browser

I am using following token-endpoint:

https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token

Thanks for providing me the links, I will check it out and comeback to let you know my outcome.
WATERKAMP, OLIVER 111 Reputation points

2020-11-03T00:57:07.19+00:00
hi @JamesTran-MSFT

thanks for trying to help me out :-)

I have not really a documentation, which shows exactly what I did.
But following video shows more or less 80% of my implementation-way: watch

I am using the client library MSAL.js (Version 2.0) (authorization_code flow) to authenticate my Angular SPA against AAD:
msal-browser

I am using following token-endpoint:

https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token

Thanks for providing me the links, I will check it out and comeback to let you know my outcome.
WATERKAMP, OLIVER 111 Reputation points

2020-11-03T08:28:24.207+00:00

hi @JamesTran-MSFT

I wrote you back, but I don't see my feedback?!

Could you maybe help?
JamesTran-MSFT 36,376 Reputation points Microsoft Employee

2020-11-03T21:09:38.62+00:00

@WATERKAMP, OLIVER
Thank you for the quick follow up and details! Can you share the full access token that you're receiving?

If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.
WATERKAMP, OLIVER 111 Reputation points

2020-11-03T22:51:35.567+00:00

Here is my access-token, which I decoded on jwt.ms:
Header
{
"typ": "JWT",
"nonce": "eVrl7h4Qy4S1XatdYaqaPLPKpRYLXwfSVmYihwHuHDc",
"alg": "RS256",
"x5t": "kg2LYs2T0CTjIfj4rt6JIynen38",
"kid": "kg2LYs2T0CTjIfj4rt6JIynen38"
}
WATERKAMP, OLIVER 111 Reputation points

2020-11-03T22:57:44.417+00:00

Sorry I can share more here in this discussion thread. The amount of chars is limited.
WATERKAMP, OLIVER 111 Reputation points

2020-11-03T23:26:24.49+00:00

Is there another way to send you the decoded access-token?
The editor here does not allow me to send some decoded token fragments ?!!?
James Hamil 21,851 Reputation points Microsoft Employee

2020-11-26T00:52:01.413+00:00

Hi, do you still require assistance? If not, please mark the answer as verified.

Thank you,
James
WATERKAMP, OLIVER 111 Reputation points

2020-11-26T08:18:56.82+00:00

Hi,

I answered already to this discussion. See the last post, which I flagged as 'Accepted Answer'.

Cheers,
Oliver

2 answers

WATERKAMP, OLIVER 111 Reputation points

2020-11-04T22:14:28.263+00:00

Hi @JamesTran-MSFT

Thanks for writing back.
After another night of investigating and debugging I found the problem.

The structure of the access-token was in ver:1.0 (I need version 2.0).

The reason because I had somehow a wrong access-token structure version were wrong set scopes.
After I correct the scopes to getting the access-token it worked everything.

Thanks for your help and we can close this thread.

Best regards,
Oliver
Please sign in to rate this answer.

1 person found this answer helpful.
JamesTran-MSFT 36,376 Reputation points Microsoft Employee

2020-11-05T17:53:24.017+00:00

@WATERKAMP, OLIVER
Thank you for the quick follow up, I'm glad you were able to resolve the issue and post the solution here for anyone in the community to leverage!

Thank you again for your time and patience throughout this issue.

Sebastian Gross 5 Reputation points

2023-05-25T06:53:15.8866667+00:00

Hi, could you explain in more deail what you did with the scopes to get token in ver 2? I am facing the same issue and am stuck :/
Sign in to comment
Ohm Sadasivam 1 Reputation point

2021-04-28T21:37:50.363+00:00

Hi,
I have the same issue. I keep getting the ver1.0 token when I get the token from my Angular MSAL call. Though my API App registered with a scope have the accessTokenAcceptedVersion = 2.
Can someone help.
Thanks
Om
Please sign in to rate this answer.
Estrada, Guillermo 1 Reputation point

2021-05-18T17:45:12.207+00:00

Did you find a solution? I did set the manifest of the registered app but the access tokens are still v1.0
Sign in to comment