Using Microsoft Graph token to secure ASP.NET Core Web API with Jwt Bearer tokens

Question

We have an ASP.NET Core Web API that I want to secure with Microsoft Graph Access token. The graph token is valid and I can do graph call it works fine.

However, If I try to access the ASP.NET Core Web API which is configured with JWT Bearer authentication, it gives the following error.

Bearer error="invalid_token", error_description="The signature key was not found

Am I missing some configurations to configure or this is a problem with graph token? Here is how the authentication is configured.

        services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
               .AddJwtBearer(options =>
               {
                   options.TokenValidationParameters = new TokenValidationParameters()
                   {
                       ValidateIssuer = false, // For multi tenant
                       ValidateIssuerSigningKey = false,
                       ValidateAudience = false // This is for testing
                   };
               });

The same configurations works fine with Azure AD Access Token.

Nan Yu · Accepted Answer · 2019-04-02 08:05:48Z

2

We have an ASP.NET Core Web API that I want to secure with Microsoft Graph Access toke

No , i suggest register your web api as a resource which protected by Azure AD .

Microsoft Graph API token is used to access the Microsoft Graph , Microsoft Graph's server side will validate the claims/signature after receiving the JWT token . In addition , i remember Microsoft Graph API access tokens are signed different from the JWT tokens which issued from AAD . So let Microsoft Graph API server side to validate the token and the token should not be used to protected other API .

Your client app could uses the OpenID Connect middleware and the Active Directory Authentication Library (ADAL.NET) to obtain a JWT bearer token for the signed-in user using the OAuth 2.0 protocol. The bearer token is passed to the web API, which validates the token and authorizes the user using the JWT bearer authentication middleware :

Calling a web API in an ASP.NET Core web application using Azure AD

answered Apr 2, 2019 at 8:05

Nan Yu

27.7k9 gold badges75 silver badges157 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

Deepak Sharma Over a year ago

The current scenario is that, we are using OAuth protocol to get the graph token, rather than getting one more token If I could just use graph token to secure the API that would greatly enhance code and usability.

Nan Yu Over a year ago

@DeepakSharma , one token is meant for one resource , i don't think that is good idea to use one token to access two protected resource . Azure AD provides SDKs for different platform which make it easy to acquire another access token using refresh token , so that you needn't login again .

Nan Yu Over a year ago

And IMO , Microsoft Graph access token is signed a bit different , it would meet problem if you validate signature yourself .

Deepak Sharma Over a year ago

Ok makes sense will consider using AAD

Collectives™ on Stack Overflow

Using Microsoft Graph token to secure ASP.NET Core Web API with Jwt Bearer tokens

1 Answer 1

4 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

4 Comments

Your Answer

Sign up or log in

Post as a guest

Related