Configure an asp.net core Web App to validate JWT token from ADFS

Question

I'm using ADFS 2019 and the scenario is:

Client App (trusted, client id and client secret)
Web Api (acts both as a server and as a client)
Resource to access

My GOAL is:

By using postman get a token from ADFS and call a Web API launched locally that must validate this token. Once the token has been validated it must generate another token (on-behalf-of) to access the last resource.

I can successfully get the first token specifying: - Grant Type: Client Credentials - Access Token URL: https://MY-ADFS/adfs/oauth2/token - Client ID - Client Secret

How can i configure my asp.net core Web Application to validate and accept this token?

I have all the data:

Web App identifier (for the server), web app client id/secret (when it acts as a client) and ADFS metadata endpoint.

I'm trying to do something like this:

services
            .AddAuthentication(o =>
            {
                o.DefaultScheme = JwtBearerDefaults.AuthenticationScheme;
            })
            .AddJwtBearer(options =>
            {
                options.Authority = "https://.../adfs";
                options.Audience = "urn:microsoft:userinfo"; // taken from client token using jwt.io
                options.MetadataAddress = "adfs metadata address";
                options.TokenValidationParameters = new TokenValidationParameters()
                {
                    ValidIssuer = "https://.../adfs/services/trust",
                    ValidAudiences = new List<string> { "web app id" },
                };

But it does not work (unauthorized or internal server error).

All these application are in the same application group in ADFS.

Thank you.

Update 1:

If i've understood correctly the audience must be WHO validates the token. So it must be the Web Api identifier inside ADFS. If i put this identifier in the audience variable i get: audience did not match. The audience that is in the token that i'm sending with postman is indeed different: urn:microsoft:userinfo!

Update 2:

I've managed to access to the web api and get a nice and valid access token. Now the problem is that the audience of the token is like:

"aud": "microsoft:identityserver:web api id on ADFS"

That "microsoft:identityserver is a problem when i have to do the "on-behalf of".

It forces me in doing:

ClientCredential clientCredential = new ClientCredential("microsoft:identityserver:client ID", "secret");

Otherwise it does not validate the audience. But doing so, when i do:

var result = await authenticationContext.AcquireTokenAsync("resource to access' id", clientCredential, userAssertion);

It tells me that it cannot find a resource with client id "microsoft:identity:client id", and that's true, because the resource on ADFS has a client ID WITHOUT the "microsoft:identity" part.

Configure an asp.net core Web App to validate JWT token from ADFS

0 Answers0