[Bug] Web App call local API cause IDX10214: Audience validation failed. #559

@mpp

Description

Which version of Microsoft Identity Web are you using?
Note that to get help, you need to run the latest version.
Microsoft Identity Web 0.3.1-preview

Where is the issue?

  • Web app
  • Sign-in users
  • Sign-in users and call web APIs
  • Web API
  • Protected web APIs (validating tokens)
  • Protected web APIs (validating scopes)
  • Protected web APIs call downstream web APIs
  • Token cache serialization
  • In-memory caches
  • Session caches
  • Distributed caches
  • Other (please describe)
  • Is this a new or an existing app?
    a. The app is in production and want to upgrade to a new version of Microsoft Identity Web.

    Repro

    // inside of Startup.cs -> ConfigureService
    services.AddMicrosoftIdentityWebAppAuthentication(Configuration)
                .EnableTokenAcquisitionToCallDownstreamApi(new string[] { Configuration["Scope"] })
                .AddInMemoryTokenCaches();
    // inside of Controller call
    var token = await _tokenAcquisition.GetAccessTokenForUserAsync(_Scopes);
    HttpClient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", token);
    HttpClient.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));
    var response = await HttpClient.GetAsync(requestUrl, HttpCompletionOption.ResponseHeadersRead);
    // response is 401 Not authorized
    

    Expected behavior
    Response 200 OK with the data I need

    Actual behavior
    I have the Web API in a project, published on Azure and the Web APP in a different project.
    If I debug the APP and call an endpoint of the APIs I receive the 401 error.
    In the debug output of the Web API I see the error message:

    Bearer was not authenticated. Failure message: IDX10214: Audience validation failed. Audiences: '92e3d039-XXXX-XXXX-XXXX-6e360645ca06'. Did not match: validationParameters.ValidAudience: 'api://92e3d039-XXXX-XXXX-XXXX-6e360645ca06' or validationParameters.ValidAudiences: 'null'.
    

    The only difference is that "api://" token.

    Do you know what I am missing and why it works with the published APIs but not with the local ones?