Hello,
I found a following description from Microsoft document.
We strongly recommend that you use Microsoft Graph instead of Azure AD Graph, Office 365 Mail API, etc.
https://docs.microsoft.com/azure/active-directory/develop/v2-permissions-and-consent
So, I attempted to use https://graph.microsoft.com (Microsoft Graph) instead of https://graph.windows.net (Azure AD Graph) as ResourceURI argument of ADALLogin action.And the JWT_ValidateToken action included in ADALLogin failed.
Validate Token and User error: IDX10503: Signature validation failed. Keys tried: '[PII is hidden]'.Exceptions caught: '[PII is hidden]'.token: '[PII is hidden]'.
How do I use Microsoft Graph instead of Azure AD Graph?
Best regards,Moriya Takasi
Hi Takasi,
Did you fill out the site property IdentityProvider ?
Did you add the correct permissions to your azure portal application (for Microsoft Graph instead of Azure AD Graph)?
To see the result of the error (instead of PII is hidden), I think we need to change the JWT extension.
IdentityModelEventSource.ShowPII = true; //To show detail of error and see the problem
https://github.com/IdentityServer/IdentityServer4/issues/2186#issuecomment-407959886
Thanks
Hello Pedro,
Thank you for your quick replying.
Yes. I filled the site property with https://sts.windows.net/<my-tenant-id>/ .And the validation succeeded when I used Azure AD Graph resource URI.
I revealed the error message by modifying the extension you mentioned.(I masked some characters.)
Validate Token and User error: IDX10503: Signature validation failed. Keys tried: 'Microsoft.IdentityModel.Tokens.X509SecurityKey , KeyId: ie_qWCXhXxt1zIEsu4c7acQVGn4 '. Exceptions caught: ''. token: '{"typ":"JWT","nonce":"mg5Xq3aHzUs-i99ftq7m7xL7r2T11xJKPJ3TMM4ji1Q","alg":"RS256","x5t":"ie_qWCXhXxt1zIEsu4c7acQVGn4","kid":"ie_qWCXhXxt1zIEsu4c7acQVGn4"}.{"aud":"https://graph.microsoft.com","iss":"https://sts.windows.net/bb49xxxx-xxxx-xxxx-xxxx-xxxxxx259d0b/","iat":1568941345,"nbf":1568941345,"exp":1568945245,"acct":0,"acr":"1","aio":"42FgYFip9n/uow9iXMUyaYmhalxpNQd2mh+15NjV7zfV8u7e57kA","amr":["pwd"],"app_displayname":"OS Azure AD Test","appid":"21b2xxxx-xxxx-xxxx-xxxx-xxxx0bdf757d","appidacr":"0","ipaddr":"153.236.207.97","name":"Test User","oid":"a1e3xxxx-xxxx-xxxx-xxxx-xxxx54a27f88","platf":"2","puid":"1003200067526BF1","scp":"Directory.AccessAsUser.All User.Read","sub":"a6vcMvQZf1EYx-LUCqOEdL8s-edImVlUrtdsx_adEIY","tid":"bb49xxxx-xxxx-xxxx-xxxx-xxxxc1259d0b","unique_name":"test@takasxxxxx.onmicrosoft.com","upn":"test@takasxxxxx.onmicrosoft.com","uti":"yi4vunNmm0O6mI8h0BBCAA","ver":"1.0","xms_tcdt":1493187223}'
Could you figure out what's the cause of it?
By the way, could you use Microsoft Graph resource URI instead of Azure AD Graph URI on your site?
I'd appreciate your helping me. Thank you. Best regards, Moriya Takasi
I searched for this error, and i found a possible solution, but, i not have time now for test this solution.
"The issue you are facing is caused by the null first byte. This is contrary to the JWA. .NET Core will account for the null byte and .NET framework, apparently, won't."
First link: https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/issues/1122#issuecomment-475805665
Second link: https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/issues/877#issuecomment-431113178
Solution: Change the ValidateToken action from extension and add code marked as a solution to the second link.
Regards
Thank you for your investigation.I applied your solution to my environment and got another error.
The input is not a valid Base-64 string as it contains a non-base 64 character, more than two padding characters, or an illegal character among the padding characters.
It seems that your code snippet assumes the length of ssAccessToken is nearly 341 bytes (= 256 or 257 * 4 / 3).However length of ssAccessToken on my environment is 1619 bytes.Head character of it is not '0'. And also head part of third block (split by period character) of ssAccessToken is also not '0'.Your solution is directing to the case the character is '0', isn't it?
ssAccessToken in my environment (some character were omitted):
eyJ0eXAiOiJKV1QiLCJub25jZSI6IkVVbkl3OEhF<<<1227 characters were omitted>>>E4NzIyM30.lOpH-2rNSZlLOSsw3UYn74Cm7WSDjq7tOtA7C4QcfJ9dsvCzW-5NDuedVP8M3Yxo12n0kP7v7DpuySkzHoNFhn9cbUPDUEB-Sc-LqhC3DKJC4o-eLjw2qnTIAnBsL2nhKoG3Fi0poIPakJrQw0PQz3PSvC9cGoZpCKhHMPzIcxNiBcfEeaOAMrdGHLBEFh9OsygrhPgB1hl53E-mqkoHEV4M3BZsTjHwuw3Qb9FjTeAusHMtgGQdqcClHH5JMg1Pevmt3jHzPsm8Nva3XmiffwVY0JryPn3dYKVEP3fiFKP2lyYcnTqem4kwW4MWoUkwimOpbdJ-U6NtyF1kzo8yig
I'd appreciate your helping.
Best regards,
Have you tried to put AccessToken here on this site https://jwt.io/ and see what the result ?
The error is only in the validate token right? Is the login working?
Thank you for comment.I got AccessToken value again and put it into jwt.io you mentioned.
Where can I find my private key to validate the signature here?
I'm thinking so. The action flow of ADALLogin performs until validation step without any errors.
Sorry for the delay, are you still having this problem?
Yes. My problem is still here.
Can you use Microsoft Graph resource URI instead of Azure AD Graph URI on your site?
What seems strange to me is that the problem is not with Login, you said that the flow runs without errors until the validation of the token. I can't find validation reason fail when using Microsoft Graph instead of Azure Graph.
You may be able to use another extension to decode the token and check the result: https://www.outsystems.com/forge/component-overview/1853/jwt
The app is well configured on the azure portal.
The site property is also well populated.
Try using this component and see the result.
Edit: See https://docs.microsoft.com/pt-br/azure/active-directory/develop/msal-overview
https://docs.microsoft.com/pt-br/azure/active-directory/develop/azure-ad-endpoint-comparison
I think I found the problem
Important
v1.0 and v2.0 tokens can be issued by both the v1.0 and v2.0 endpoints! id_tokens always match the endpoint they're requested from, and access tokens always match the format expected by the Web API your client will call using that token. So if your app uses the v2.0 endpoiont to get a token to call Microsoft Graph, which expects v1.0 format access tokens, your app will recieve a token in the v1.0 format.
Differences between ADAL and MSAL
Active Directory Authentication Library (ADAL) integrates with the Azure AD for developers (v1.0) endpoint, where MSAL integrates with the Microsoft identity platform (v2.0) endpoint. The v1.0 endpoint supports work accounts, but not personal accounts. The v2.0 endpoint is the unification of Microsoft personal accounts and work accounts into a single authentication system. Additionally, with MSAL you can also get authentications for Azure AD B2C.
For more specific information, read about migrating to MSAL.NET from ADAL.NET and migrating to MSAL.js from ADAL.js.
I tried to use JWT extension you mentioned. But I couldn't figure out both which action I have to use and what values I have to assign to arguments of the action.
Do you mean that Microsoft Graph resource URI (https://graph.microsoft.com) is for MSAL, not for ADAL?
Yes, Microsoft Graph is used in v2.0 endpoint, and Adal plugin uses endpoint v1.0.
And the token generated for each endpoint is different.
So, it was natural that I could not use the ADALPlugin with Microsoft Graph resource URI.It all makes sense now.
Thank you for your helping me.
Do you have a plan to release a new plugin for v.2.0 endpoint?
I should have time to look into this from Wednesday.
Should I create a new component for MSAL Auth
I'm glad to hear from you.Adding MSALLogin action to current component is also welcome for me.
Pedro Costa wrote:
Any news about MSAL Auth?
or v.2.0 endpoint for ADAL?Best Regards,PVN
Hi Pedro,
Some news about MSALLogin?
Maycon Silva
Hi !Unfortunately I still haven't had time to finish the component.Did you try to use this other component?
https://www.outsystems.com/forge/component-overview/2044/idp-mobile