locked
aud parameter returned in JWT is not correct. RRS feed

  • Question

  • User2054385235 posted

    My problem appears to be a bug in the Microsoft implementation.

    I am using the documentation at:

    https://msdn.microsoft.com/en-us/library/dn631824.aspx

    One of the things that is returned in a JWT is the "aud" parameter which is the audience.

    According to the Open ID Connect spec:

    aud REQUIRED. Audience(s) that this ID Token is intended for. It MUST contain the OAuth 2.0 client_id of the Relying Party as an audience value. It MAY also contain identifiers for other audiences. In the general case, the aud value is an array of case sensitive strings. In the common special case when there is one audience, the aud value MAY be a single case sensitive string.

    My client id is 00000001234 (not my real ID, just an example).

    I make it through the handshake and everything is groovy, I get my nonce "code" from Windows Live, then I exchange it for my token, but the token I get back has an "aud" value of:

    00000000-0000-0000-0000-00000001234

    When doing token validation I check "aud" value in the returned token and the "aud" does not match the configured cliend_id, which it should, according to the spec.

    My question is, other than not validating the audience of the token, is there any way to configure the app, in the MS Developer console so that it returns the client ID correctly for the "aud" value in the returned token?

    Friday, June 19, 2015 3:13 PM

All replies

  • User-103761908 posted

    This question might be better asked in the Security group?

    Saturday, June 20, 2015 7:24 AM
  • User1779161005 posted

    The aud claim usually maps to your client id -- this means it's typically defined by the provider (live in this case). So it seems like a bug (somewhere) that you're able to pass the wrong client id and get back a token. Try passing the longer client id in the initial request and see what live does.

    Saturday, June 20, 2015 7:51 AM