CODEWITHSUNDEEP
azureazure-active-directoryazure-ad-b2c
Pinkesh Patel
Pinkesh Patel

Reputation: 47

Microsoft.IdentityModel.LoggingExtensions.IdentityLoggerAdapter Error Logs in AzureAD Auth Implementation

We have integrated AzureAD for our API Authorization and API Auth is working fine but seeing error logs for Microsoft.IdentityModel.LoggingExtensions.IdentityLoggerAdapter with below messages,

IDX40003: Neither tid nor tenantId claim is present in the token obtained from Microsoft identity platform.

IDX10516: Signature validation failed. Unable to match key: kid: '*'. Number of keys in TokenValidationParameters: '16'. Number of keys in Configuration: '0'. Exceptions caught: '[PII of type 'System.Text.StringBuilder' is hidden. For more details, see https://aka.ms/IdentityModel/PII.]'. token: '[PII of type 'System.IdentityModel.Tokens.Jwt.JwtSecurityToken' is hidden. For more details, see https://aka.ms/IdentityModel/PII.]'. Valid Lifetime: 'False'. Valid Issuer: 'False'**

Our APIs are being consumed by UI APP as well as via Swagger/Postman.

What should be root cause to it?

Upvotes: 0

Views: 2180

Answers (1)

kavya Saraboju
kavya Saraboju

Reputation: 10871

The error IDX10516: Signature validation failed. Unable to match key: kid occurs when the Kid in your decoded token which validates token signature is not valid. So one needs to load keys from the openid provider.

code:

var openidConfiguration = new ConfigurationManager<OpenIdConnectConfiguration>(
                $"https://login.microsoftonline.com/{tenantid}/v2.0/.well-known/openid-configuration",
                new OpenIdConnectConfigurationRetriever(),
                new HttpDocumentRetriever());
            var config = await openidConfiguration.GetConfigurationAsync();

            var parameteres = new TokenValidationParameters()
            {
                RequireAudience = true,
                RequireExpirationTime = true,
                ValidateAudience = true,
                ValidateIssuer = true,
                ValidateLifetime = true,
                ValidAudiences = new[] { "<my client id or appId uri or resource identitifer>" },
                ValidIssuers = new[] { $"https://sts.windows.net/{tenantid}/" }, 
                IssuerSigningKeys = config.SigningKeys
            };
  • AppId Uri , you can check from the portal : api://

enter image description here

Add the following to check for more clear descriptive exception in ConfigureServices method in Startup.cs :IdentityModelEventSource.ShowPII = true

Example:

public void ConfigureServices(IServiceCollection services)
        {
            
                     ...
            IdentityModelEventSource.ShowPII = true;
                       ...
             }

Reference : Azure AD - Why can't I validate JWT token issued by Azure AD for my Web API? Getting "IDX10516: Signature validation failed" error - Stack Overflow

Upvotes: 0

Related Questions