How do I secure a webapi?

Abhijit Shrikhande 317 Reputation points
2021-03-24T21:11:29.227+00:00

I have registered an App on the portal.azure.com website. I downloaded the project that the site gives for the purpose of integration. After I've restored all the Nuget packages associated with this project, I am able to compile it.

However, when I attempt to sign in to the Azure AD, I get the following message.

Error: IDX10205: Issuer validation failed. Issuer: 'System.String'. Did not match: validationParameters.ValidIssuer: 'System.String' or validationParameters.ValidIssuers: 'System.String'.

I have tried to change the value of accessTokenAcceptedVersion from null to "2" and neither values seem to make a difference in the outcome. All I wish to do is have the user provide an access token granted by AzureAD before he can call into the WebAPI.

The project is being developed in ASP .NET and not ASP .NET core.

Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
19,472 questions

3 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Yan Li 11 Reputation points Microsoft Employee
    2022-03-24T08:55:19.483+00:00

    Add the line into start up class

    186379-image.png

    2 people found this answer helpful.
    0 comments
  2. Daniel Harrison 1 Reputation point
    2021-12-09T18:57:49.907+00:00

    Have you set ValidateIssuer to false in the OWIN startup class as shown in the documentation? Bear in mind that you would want to validate the issuer in a real application.

    See here: https://learn.microsoft.com/en-us/azure/active-directory/develop/quickstart-v2-aspnet-webapp#owin-startup-class

    0 comments
  3. Ali Sufyan Butt 86 Reputation points MVP
    2022-03-26T13:32:45.76+00:00

    As I understood from the question that he wants to validate the issuer, I think you need to create an app in Azure AD for the website, and supply proper configuration parameters if they are missed.

    0 comments