UserDelegationKey fails with 500

[NaridaL]

UserDelegationKey fails with 500

[NaridaL]

OK, issue seems to be that the claims "tid" and "oid" were missing from by dummy auth token. These should probably be validated as part of the token validation.

For reference here is a TokenCredential which works:

namespace My.Test.Framework;

using System;
using System.IdentityModel.Tokens.Jwt;
using System.Security.Claims;
using System.Security.Cryptography;
using System.Threading;
using System.Threading.Tasks;
using Azure.Core;
using Microsoft.IdentityModel.Tokens;

public class SelfSignedTokenCredential : TokenCredential
{
    private readonly TimeSpan _expiration = TimeSpan.FromHours(1);
    private readonly string _tenant = "aaaaaaaa-aaaa-aaaa-0000-aaaaaaaaaaaa"; 
    private readonly string _issuer = $"https://sts.windows.net/aaaaaaaa-aaaa-aaaa-0000-aaaaaaaaaaaa/";
    private readonly byte[] _secret = RandomNumberGenerator.GetBytes(32);

    public override async ValueTask<AccessToken> GetTokenAsync(
        TokenRequestContext requestContext,
        CancellationToken cancellationToken)
    {
        return GetToken(requestContext, cancellationToken);
    }

    public override AccessToken GetToken(TokenRequestContext requestContext, CancellationToken cancellationToken)
    {
        var audience = requestContext.Scopes.Length > 0 ? requestContext.Scopes[0] : "default-audience";
        audience = audience.Replace("//.default", "/");
        var expires = DateTimeOffset.UtcNow + _expiration;
        var token = GenerateJwtToken(audience, DateTime.UtcNow - TimeSpan.FromMinutes(5), expires.UtcDateTime);
        return new AccessToken(token, expires);
    }

    private string GenerateJwtToken(string audience, DateTime notBefore, DateTime? expires)
    {
        var securityKey = new SymmetricSecurityKey(_secret);
        var credentials = new SigningCredentials(securityKey, SecurityAlgorithms.HmacSha256);

        return new JwtSecurityTokenHandler().CreateEncodedJwt(
            issuer: _issuer, 
            audience: audience,
            subject: new ClaimsIdentity(new []
            {
                new Claim("oid", "c0ffee00-c0ff-eeee-0000-c0ffee000000"),
                new Claim("tid", _tenant),
            }),
            notBefore: notBefore,
            expires: expires,
            issuedAt: null,
            signingCredentials: credentials);
    }
}

[blueww]

@EmmaZhu

Would you please help to look at this issue?