Invalid Audience error for JWT Bearer token

[dawidboloz]

Hi,

For more than 2 weeks I have been experiencing an issue with Authorisation on Azure Function App (.net 6.0, in-process, v4) on my TEST environment.
The function was working correctly for a long time before and there was no change done lately. Suddenly the issue starts to appear successively in all our other environments (QA, PROD) with 7 days and 2 days of delay.

The weird this is that my startup configuration, specifically, is not validating the tokens audience, see the configuration.

.AddJwtBearer(options =>
{
    options.Authority = //taken from appsettings
    options.TokenValidationParameters.ValidateAudience = false;
    options.RequireHttpsMetadata = true;
    options.Events = jwtBearerEvents;
})

The most problematic thing is that the issue is not reproducible locally on the VisualStudio, and started from nothing.

The error I have:

Bearer error="invalid_token", error_description="The audience 'api1 api2 api3 api4' is invalid

the 'api1 api2 api3 api4' is the whole audience present in the token

I contacted Azure Support and they advised me to use "Custom Bearer" because apparently

"Bearer" schema is used by Azure Functions with their handler

They also suggested more or less the same as here in the "Accepted answer": microsoft learn

I would like to ask if anyone is experiencing the same issue? And if this package is prepared for, apparently, not supporting "Bearer" schema anymore?

[dawidboloz]

I tried the solution from Issue 19 and, it seems, it helped.

[artmasa]

@dawidboloz based on what you say it seems they have changed the behavior recently. I'm wondering if removing built-in config should be enabled by default for this extension, instead of having to explicitly setting it to true.

[dawidboloz]

@artmasa I have the feeling with the current Azure function app configuration, there is no way to use a token with "Bearer" schema without removing the built-in config. Unless we guess what audience and scope names are required in the built-in config and merge it to the token we have :)

Having this by default in this extension will make the .AddJwtBearer usable as right now it is hard to find a workaround from Issue 19, but the decision is not up to me.

[artmasa]

@dawidboloz, It seems they are looking into fixing this with this PR 9701. I'm still preparing a change to remove existing configuration as the default behavior.

[artmasa]

@dawidboloz, here is the PR #23 switching the default behavior to remove any Bearer configuration from the Host

[artmasa]

I will go ahead and close this issue. New default behavior is contained in 3.1.3 release package