The audience is invalid error

Question

I have 3 projects 1- Javascript SPA 2- Web API Project, 3- IdentityServer with EF Core

I started debugging API and Identity Server and successfully get the jwt token but

Answer 1

See here for what this claim is about:

The aud (audience) claim identifies the recipients that the JWT is intended for. Each principal intended to process the JWT MUST identify itself with a value in the audience claim. If the principal processing the claim does not identify itself with a value in the aud claim when this claim is present, then the JWT MUST be rejected....

So your API's name must exist in the aud claim for the JWT to be valid when it is validated by the middleware in your API. You can use jwt.io to look at your token by the way, that can be useful to help make sense of it.

In order to have IdentityServer to add your API's name to the aud claim your client code (which is attempting to get a resource from the API and therefore needs an access token) should request a scope from your API. For example like this (from an MVC client):

app.UseOpenIdConnectAuthentication(new OpenIdConnectOptions
{
    Authority = Configuration["IdpAuthorityAddress"],
    ClientId = "my_web_ui_id",
    Scope = { "api1" },

    //other properties removed...
});

Answer 2

To avoid the error, audience should be consistently added in 4 places

1.In My (e.g. MVC) client as custom Scope.
2. In API application as ApiName
3.In IdentityServer Clients configuration as AllowedScope
4.In API Resourcesconfiguration as ApiResource

See details ( previously available in IdentityServer4 wiki):

When configuring a new API connection in identityServer4, you can get an error:

WWW-Authenticate: Bearer error="invalid_token", 
error_description="The audience is invalid"

To avoid the error, Audience should be consistently added in 4 places

1.In My (e.g. MVC) client as custom Scope :

app.UseOpenIdConnectAuthentication(new OpenIdConnectOptions
{
    Authority = Configuration["IdpAuthorityAddress"],
    ClientId = "my_web_ui_id",
  Scope = { "openid", "profile", "offline_access", "MyApi" },               

//other properties removed for brevity...
});

2.In API application as ApiName

  var identityServerAuthenticationOptions = new IdentityServerAuthenticationOptions()//Microsoft.AspNetCore.Builder.IdentityServerAuthenticationOptions
        {
            Authority = Configuration["Authentication:IdentityServer:Authority"],
            RequireHttpsMetadata = false,

            EnableCaching = false,

            ApiName = "MyApi",
            ApiSecret = "MyApiSecret"
        };

3. In IdentityServer \IdentityServerHost\Configuration\Clients.cs (or corresponding Clients entry in the database)

   var client = new Client
   {
       ClientId = clientId,  
       //other properties removed for brevity...   
       AllowedScopes =
       {
           IdentityServerConstants.StandardScopes.OpenId,
           IdentityServerConstants.StandardScopes.Profile,
           //IdentityServerConstants.StandardScopes.Email,
           IdentityServerConstants.StandardScopes.OfflineAccess,
           "MyApi",
         },
   };
   

4.In IdentityServer \IdentityServerHost\Configuration\Resources.cs (or corresponding ApiResource entry in the database) as apiResource.Scopes

 var apiResource = new ApiResource
        {
            Name = "MyApi",
            ApiSecrets =
            { 
                new Secret("MyApiSecret".Sha256())
            },
            UserClaims =
            {
                JwtClaimTypes.Name,
                JwtClaimTypes.Profile,

            },
        };