AzureAD / SCIMReferenceCode

Reference code to build a SCIM endpoint to automate provisioning
MIT License
163 stars 107 forks source link

JWT Token with Issuer and Audience for One Azure Tenant Used by Another Tenant in SCIM Application #100

Open Ashish0016 opened 4 months ago

Ashish0016 commented 4 months ago

I am configuring Azure User provisioning for my .NET Core web API project. I have created a sample SCIM application and deployed it on a Windows server. A specific token is generated for the application within a particular tenant. The token has the following issuer and audience:

When I test the connection for the tenant with the corresponding URL and valid token, it works as expected. However, the problem arises when I test the connection with an application inside a different tenant. Surprisingly, the connection is still successful. The following tenantId I have used with the application Id as mentioned below and It's working fine. https://i.sstatic.net/AJYyfo78.png

But the problem is that it is working with another Tenant as well. Expected result :- When I generate the token for one tenant, it should work only for the applications which exists in that tenant. Test connection should fail for other tenants if the token is not generated for them.