Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

issue in error message when no audience field present

See original GitHub issue

Currently, I’m receiving the following error message:

Error validating identity token: Microsoft.IdentityModel.Tokens.SecurityTokenInvalidAudienceException: IDX10214: Audience validation failed. Audiences: 'System.String'. Did not match: validationParameters.ValidAudience: 'System.String' or validationParameters.ValidAudiences: 'System.String'.
   at Microsoft.IdentityModel.Tokens.Validators.ValidateAudience(IEnumerable`1 audiences, SecurityToken securityToken, TokenValidationParameters validationParameters)
   at System.IdentityModel.Tokens.Jwt.JwtSecurityTokenHandler.ValidateTokenPayload(JwtSecurityToken jwtToken, TokenValidationParameters validationParameters)
   at System.IdentityModel.Tokens.Jwt.JwtSecurityTokenHandler.ValidateToken(String token, TokenValidationParameters validationParameters, SecurityToken& validatedToken)
   at IdentityModel.OidcClient.IdentityTokenValidator.ValidateSignature(String identityToken, JwtSecurityTokenHandler handler, TokenValidationParameters parameters)
   at IdentityModel.OidcClient.IdentityTokenValidator.ValidateAsync(String identityToken, CancellationToken cancellationToken): ArgumentException
[...]

When trying to validate a JWT with the payload:

{
  "sub": "e1d79921-0795-4111-afee-431b1b411a74",
  "event_id": "431d9076-78a1-4d63-b431-4612c2ddb842",
  "token_use": "access",
  "scope": "openid profile email",
  "auth_time": 1588693872,
  "iss": "[CENSORED]",
  "exp": 1588697472,
  "iat": 1588693872,
  "version": 2,
  "jti": "ba3837df-16d1-48b2-a3e6-ce9aafe1e455",
  "client_id": "[CENSORED]",
  "username": "asdfasdf"
}

as there is no audience, the field should not be validated per the JWT spec. However, I’m not really able to dig into what’s going on without more info from that error message. It looks like it’s being thrown here.