CODEWITHSUNDEEP
azurejwtazure-active-directoryazure-functionsazure-ad-b2c
James Wood
James Wood

Reputation: 17562

Azure Active Directory, Allowed Token Audiences doesnt appear to do anything

I have Azure AD B2C, and am I using it to secure an Azure Function. Users authenticate with the Azure Function by providing a JWT Bearer Token for authorization in the header.

This all works correctly.

I have now tried to apply the Allow Token Audience in the Authentication / Authorization configuration panel.

enter image description here

I had thought Allow Token Audience would validate the audience (aud) claim of my JWT token - which for my JWT token matches my Client Id.

This does not appear to be the case. All the values I supplied for Allow Token Audience are incorrect, but users are still successfully authenticated.

How is Allow Token Audience supposed to be used?

Upvotes: 4

Views: 3620

Answers (1)

mattchenderson
mattchenderson

Reputation: 1620

Per the comments, the issue seems to be that the client ID is accepted as an audience. This is expected behavior. App Service always allows the client ID and the base site URL (yoursite.azurewebsites.net) as valid audiences. The "Allowed token audiences" option is meant to provide additional audiences, such as if you were using a custom domain, etc.

This is certainly confusing. There are probably UX improvements that could communicate this better (info balloon, list entries that can't be removed, etc.).

Upvotes: 2

Related Questions