8

I have created a sample application where the user can authenticate with Azure B2C which works fine. I get back the Token and the AuthenticationResult. Both are Ok. But I want to get back the ClaimPrincipal from the token. To do this I have added the System.IdentityModel.Tokens.Jwt (5.4.0) nuget package to the project.

With the following code I try to achieve:

string Token = "eyJ0eXAiOiJKV1QiLCJhbGciO*****"; //long token
JwtSecurityTokenHandler jwt = new JwtSecurityTokenHandler();

var validateParams = new Microsoft.IdentityModel.Tokens.TokenValidationParameters()
        {
          ValidIssuer = Authority, //https://login.microsoftonline.com/tfp/MYTEANANTNAME.onmicrosoft.com/MYPOLICYNAME/v2.0/" 
          ValidAudience = clientId,  //CLIENTID: Like: b430xxxx-xxxx-xxxx-xxxx-f5c33cxxxxxx
          ValidateAudience = true,
          ValidateLifetime = true,
          ValidateIssuer = true,
        };

SecurityToken secToken;
var claimPrincipal = jwt.ValidateToken(Token, validateParams , out secToken);

But all the time when the ValidateToken is hit it throws the following exception:

IDX10501: Signature validation failed. Unable to match keys: 
kid: '[PII is hidden]', 
token: '[PII is hidden]'.

Do you have any advice how I should resolve this issue?

In this case the application is a .net core console app, but in the end this code will be in an WPF application.

Attila Turóczy
  • 81
  • 1
  • 1
  • 3
  • 1
    Your authority might be wrong. Check your fiddler to see. https://stackoverflow.com/questions/43276977/azure-ad-b2c-error-idx10501-signature-validation-failed – Marilee Turscak - MSFT Apr 25 '19 at 23:22
  • Possible duplicate of [JWT SecurityTokenInvalidSignatureException using RS256 PII is hidden](https://stackoverflow.com/questions/50590432/jwt-securitytokeninvalidsignatureexception-using-rs256-pii-is-hidden) – Carlo Bos May 03 '19 at 18:54

1 Answers1

11

You can get a more detailed error when you set the following flag. This will replace the [PII is hidden] (aka: Personal Identifiable Information) with the actual error.

IdentityModelEventSource.ShowPII = true;
Carlo Bos
  • 3,105
  • 2
  • 16
  • 29