SecurityTokenInvalidIssuerException with OpenID Connect and the Azure AD "common" endpoint

When you use OpenID Connect against Azure AD’s “common” endpoint, configuring https://login.microsoftonline.com/common/v2.0 as the OpenIdConnectOptions.Authority value, the metadata document will provide an issuer value of https://login.microsoftonline.com/{tenantid}/v2.0. Note the “{tenantid}” placeholder.

Within an actual ID token, the issuer value no longer contains that placeholder, but the actual tenant ID determined by the user logging in (e.g., https://login.microsoftonline.com/9188040d-6c67-4c5b-b112-36a304b66dad/v2.0). This causes the issuer validation in Microsoft.IdentityModel.Tokens to fail.

I guess Azure AD decided to return an issuer with a non-standard (?) placeholder here, but shouldn’t the code in azure-activedirectory-identitymodel-extensions-for-dotnet be able to deal with such Azure AD specifics? If so, I’d consider this a bug.

Also, the exception message is IDX10205: Issuer validation failed. Issuer: 'System.String'. Did not match: validationParameters.ValidIssuer: 'System.String' or validationParameters.ValidIssuers: 'System.String'. Which is not at all helpful, but I’ll open a separate issue for this.

[jennyf19]

This issue will be resolved when Microsoft.IdentityModel picks up the AadIssuerValidator from Microsoft.Identity.Web. We are in the process of moving it over now. Should be in next IdentityModel release hopefully.

[fschmied]

@jennyf19 Thanks for the pointer (and sorry for the delay). My point was that using the validator will not be possible using appsettings.json. So, if we want to support Azure AD multitenancy, we’ll have to adapt our application code.

Also thank you for the quick reaction!