Getting Error Code AADB2C90233 when attempting token validation (Invite Template)

[azure-ad-b2c]

Getting Error Code AADB2C90233 when attempting token validation (Invite Template)

[JasSuri]

Share a copy of the id_token_hint here, and also share your id token hint technical profile. Do not censor it.

[stephenstroud]

@JasSuri

https://homingpigeon.b2clogin.com/homingpigeon.onmicrosoft.com/B2C_1A_signup_invitation/oauth2/v2.0/authorize?client_id=20590fb4-60f8-4c6b-bbd3-8bc79a375f1a&nonce=abe9d6ab1d0c421fa88dc9e7682636b8&redirect_uri=https%3A%2F%2Fjwt.ms&scope=openid&response_type=id_token&id_token_hint=eyJhbGciOiJSUzI1NiIsImtpZCI6IjdGNjMzNDJBMTkzMDI2MjRFMkVFM0U2QzA2RTJBNUY4NkZGRTlERkIiLCJ4NXQiOiJmMk0wS2hrd0ppVGk3ajVzQnVLbC1HXy1uZnMiLCJ0eXAiOiJKV1QifQ.eyJuYW1lIjoiV2VzdGVybiBNaWxsZXIiLCJlbWFpbCI6ImhvbWluZ3BpZ2VvbkBleGFtcGxlLmNvbSIsIm5iZiI6MTU4OTIyMTcwNiwiZXhwIjoxNTg5ODI2NTA2LCJpc3MiOiJodHRwczovL2hvbWluZ3BpZ2Vvbi5vbm1pY3Jvc29mdC5jb20vIiwiYXVkIjoiMjA1OTBmYjQtNjBmOC00YzZiLWJiZDMtOGJjNzlhMzc1ZjFhIn0.DX8wtmCnJwpn2vW_uXdHOkHH6v60b5m-I92cDqH502bygQlSMyDBuZofno6KUugivIH2zDhH1T4CU9LTs7I1acj0i-vl3WFTooSOdJRT07PsH80hxISJdp5wJp2F38sxeX2oh-dOcupun9hJi0vjYMy5p5TB1Yqw3R2W809dnhhcx0EgaODpGsJBsSQtzm56MajOX0oyXs3Ol4RRxv28ylxwWY9cYDBB9Lxr-EQut6cJ13vtS2r2I9l6Cy0WEVGksJF545DusBWFBl7uDs0x7QGf525ULX_JPbXM_vqY7LBeppij1DiTMwxQ6D70lya4SOzvHqpebSZyE7bNoyU1CQ

<ClaimsProvider>
      <DisplayName>My ID Token Hint ClaimsProvider</DisplayName>
      <TechnicalProfiles>
        <TechnicalProfile Id="IdTokenHint_ExtractClaims">
          <DisplayName> My ID Token Hint TechnicalProfile</DisplayName>
          <Protocol Name="None" />
          <Metadata>
          
            <!--Sample action required: replace with your endpoint location -->
            <Item Key="METADATA">https://homingpigeon.b2clogin.com/homingpigeon.onmicrosoft.com/B2C_1A_signup_invitation/v2.0/.well-known/openid-configuration</Item>
        
            <!-- <Item Key="IdTokenAudience">your_optional_audience_override</Item> -->
            <!-- <Item Key="issuer">your_optional_audience_override</Item>-->
          </Metadata>
          <OutputClaims>
            <!--Sample: Read the email cliam from the id_token_hint-->
            <OutputClaim ClaimTypeReferenceId="email" />  
          </OutputClaims>
        </TechnicalProfile>
      </TechnicalProfiles>
    </ClaimsProvider>

[stephenstroud]

@JasSuri Looks like I figured it out thanks to your prompt - however, I'm still having issues with the issuer. I'm issuing from an Azure function and using the .well-known/openid-configuration URL which is displayed within the endpoint section of the Azure B2C GUI. What would the issuer need to be in this case given the above?

[JasSuri]

Since the issuer in your token is https://homingpigeon.onmicrosoft.com/
And the issuer in the OIDC Config is https://homingpigeon.b2clogin.com/1fb401b8-db27-4874-88a0-d3d3525f568c/v2.0/, its going to fail.

Either change the issuer in the token by looking at the code. Or override this key in B2C policy:

<Item Key="IdTokenAudience">https://homingpigeon.onmicrosoft.com/</Item>

[stephenstroud]

@JasSuri Thanks that did it! :)