Exception "The client_id / audience is invalid!" when using accesstoken

[kingma-sbw]

I get an exception when using a token.

This is how I save the token after succesfull logon:

$token = $provider->getAccessToken( 'authorization_code', [ 
    'code' => $_GET[ 'code' ],
] );
$_SESSION['accessToken'] = $token->getToken() );

This is how I use the stored access token (for debugging I use the token in the session:

$accessToken = $_SESSION['accessToken'];

try {
    $claims = $provider->validateAccessToken($accessToken);
    var_dump($claims);
} catch (Exception $e) {
    var_dump($e);
}

I've checked the token and it is the value created.

[decomplexity]

What please is the value of AUD in the token claims?

[kingma-sbw]

ehm. AUD token? where ist that set?

[decomplexity]

Ah. I assumed that your "I've checked the token and it is the value created" meant that you had decoded the access token. You can easily check the client id. But to check the audience:

• go to https://jwt.io/ , paste your token in there,. and look for the AUD (audience) claim. If the result is garbage,; de-Base64 the token first using https://www.base64decode.org/

[kingma-sbw]

I see thanks, I could see the content. But how is the validateAccessToken supposed to work? I assumed in an API call I can do a quick test to check it the the session is (still) valid.

[decomplexity]

Since the error message is saying that either or both of the client ID (which you input) and AUD (which you didn't) are bad, could you please reply with the AUD value - it is not sensitive. If the token had timed out - they have a very short life of perhaps an hour, or the key signature was bad - I would hope that the error message would say so.

[kingma-sbw]

If I decode the result of getToken and base64_decode it I get something proper but also some garbage at the end

�$@RD_BZC^Pv~9P`�8BZqyt]^D)>ϧEꮉT<`,_#ⴅ3uoR,?orwIjB@dX )RtPtI_C=/Ae-j$tm.\.7j`D:nsʽp垝
M[&d%LbȈ
>   wp!yJSKPs\7j$ 

And json_encode cannot use it.

but the AUD is "https://graph.windows.net/",

[decomplexity]

I cannot tell what the garbage is, but if you are using Graph as the resource provider, the AUD should be https://graph.microsoft.com. If instead you are using a non-Microsoft package such as PHPMailer to send SMTP mail, the AUD must be https://outlook.office.com/ or authentication will fail; this AUD is forced using a Scope operand

[kingma-sbw]

Thanks. but what I see we don't need the results from getToken, only the getResourceOwner data which we will store in a PHP session variable.