JWT has an invalid signature

[ShrayRastogi]

The access token stored in the APIM cache which is mapped to session key has an invalid signature. Though the JWT itself is valid, however, does not have any valid signature and it is causing the issue at various downstream levels where JWT validation failing.

Further using the token in exchange flows through MSAL or Azure.Identity also deems the signature invalid -

Is it because we are assigned APIMGatewayURL as an issuer while the issuer in the token is different (https://sts.windows.net/tenantId) ?
Pranami Jhawar (@prjhawar) Julia Kasper (@jukasper) - Kindly help with this issue.

[ShrayRastogi]

Pranami Jhawar (@prjhawar) / Julia Kasper (@jukasper) - Any comments here?

[ShrayRastogi]

Julia Kasper (@jukasper) / Pranami Jhawar (@prjhawar) - requesting any advice here?

[svandenhoven]

I have the same issue.

The current solution requests an access token for "openid https://graph.microsoft.com/.default" (see readme). This results in an access token with the audience: "https://graph.microsoft.com", with a signature that is invalid.

I can resolve this by adding a scope to the created app registry "access_as_user" (in Expose an API) and requesting the scope "api://[clientid]/access_as_user" instead of "openid https://graph.microsoft.com/.default". (required some changes in bicep and policies, that I am happy to share)

This returns a valid access token with a valid signature.

IMO requesting an access token for "https://graph.microsoft.com/.default" and sending this access token to the MCP Server is not the correct way as this acccess token is meant for Microsoft Graph API and not for the MCP Server (the purpose of audience claim). With the standard check of iss, aud and scp any access token created for Microsoft Graph can be sent to the MCP Server and will be validated and used.

In the current solution the claim appid in the access token does contain the client id, but this should not be used for authorization purposes afaik.

It would be more secure and recommended practice imo, to request an access token dedicated for the MCP Server and use OBO to request additional access token if needed. Then a check on the audience can be done in the MCP Server code (the azure functions in this case) and misuse of other access tokens is prevented.

[ShrayRastogi]

Sander van den Hoven (@svandenhoven) - thank you for your inputs, it does make sense to not use the graph audience and I tried something similar you have suggested. Kindly share the changes you made in bicep and policies. Thanks again for taking the time.

[svandenhoven]

@svandenhoven - thank you for your inputs, it does make sense to not use the graph audience and I tried something similar you have suggested. Kindly share the changes you made in bicep and policies. Thanks again for taking the time.

Shray Rastogi (@ShrayRastogi) I have created a fork on my own GitHub, as the functionality is different. I have made a draft PR at: #27, to check the changes.

1. I have added in mcp-api.policy.xml the ability to send the token (token result of auth) in the params.arguments of the MCP Message
2. In entra-app.bicep I have added a new scope "access_as_user" to the created app registration. This scope will be used to get access token for access_as_user instead of https://graph.microsoft.com/User.Read. In addition, I set the Application URI ID in the app registration to api://clientid.
3. In oauth-callback.policy.xml I have changed the requested scope to api://clientid/access_as_user
4. In oauth.bicep have made change to save the new scope in OAuthScopes in the Named Values of APIM
5. In main.bicep changed the variable oauth_scopes from https://graph.microsoft.com/.default to access_as_user
6. In function_app_py added a validate_token tool/function, such that it gets the access_token and validates it. I have added the jwt token validation function.

This changed the application consent page into this (check that scopes now have change)

When running the inspector and executing the hello_mcp tool it will return the result of the token validation. It now only validate signature and does validate audience and issuer.

Hope this helps.

Pranami Jhawar (@prjhawar): If desired I can publish the PR to this repo so the validate_token function becomes part of the sample. The get_snippet, hello_mcp and save_snippet tools remain to work as before.