title: "authentication failed due to: jwt audience is invalid" with Azure AD
body: <p>First I'm describing how I setup my applications then I will describe how I'm using the APIs.</p>
  
  <h2>Setup</h2>
  
  <ol>
  <li>In my <strong>Azure Active Directory</strong>, I have two applications registered: UI and Backend</li>
  <li>UI has the client ID clientId1 and backend has client ID clientId2 (it's a GUID, but for simplicity)</li>
  <li>Both are under the same tenant tentant1 (single tenant)</li>
  </ol>
  
  <h3>Backend (Web API)</h3>
  
  <ol>
  <li>Backend has an exposed API with scope "api://clientId2/access_as_user" and authorized client "clientId1" with the scope just mentioned selected</li>
  <li>I'm using <code>passport</code> and <code>passport-azure-ad</code> (I pretty much copied <a href="https://github.com/Azure-Samples/active-directory-javascript-nodejs-webapi-v2" rel="nofollow noreferrer">https://github.com/Azure-Samples/active-directory-javascript-nodejs-webapi-v2</a>). </li>
  <li><p>My config:</p>
  
  <pre><code>const config = {
      identityMetadata: "https://login.microsoftonline.com/tenant1/v2.0/.well-known/openid-configuration",
      clientID: "clientId2",
      validateIssuer: false,
      loggingLevel: 'info',
      passReqToCallback: false,
      loggingNoPII: false
  };
  </code></pre></li>
  <li>I get this message when starting the server:</li>
  </ol>
  
  <blockquote>
  <pre><code>{"name":"AzureAD: Bearer Strategy","hostname":"DESKTOP-NCVLN56","pid":16052,"level":40,"msg":"Production environments should always validate the issuer.","time":"2020-04-11T13:25:44.283Z","v":0}
  {"name":"AzureAD: Bearer Strategy","hostname":"DESKTOP-NCVLN56","pid":16052,"level":30,"msg":"In BearerStrategy constructor: created strategy with options {\"identityMetadata\":\"https://login.microsoftonline.com/tenant1/v2.0/.well-known/openid-configuration\",\"clientID\":\"clientId2\",\"validateIssuer\":false,\"loggingLevel\":\"info\",\"passReqToCallback\":false,\"loggingNoPII\":false,\"clockSkew\":300,\"allowMultiAudiencesInToken\":false,\"audience\":[\"clientId2\",\"spn:clientId2\"]\"isB2C\":false,\"_isCommonEndpoint\":false}","time":"2020-04-11T13:25:44.285Z","v":0}
  Listening on port 5000
  </code></pre>
  </blockquote>
  
  <h2>UI (Angular SPA)</h2>
  
  <ol>
  <li>UI has permissions was granted automatically permission to access Microsoft Graph (profile, user.read, user.read.all -- last one I think I granted). The permissions are in "API permissions"</li>
  <li>I went ahead and also granted access to the Backend access_as_user</li>
  <li>For the UI code I'm using the MSAL library and again I pretty much copied the repo (<a href="https://github.com/Azure-Samples/active-directory-javascript-singlepageapp-angular" rel="nofollow noreferrer">https://github.com/Azure-Samples/active-directory-javascript-singlepageapp-angular</a>)</li>
  <li>In the <code>protectedResourceMap</code> field I added the following</li>
  </ol>
  
  <pre><code> ['https://graph.microsoft.com/v1.0/me', ['user.read']],
   ['http://localhost:5000', ['api://clientId2/access_as_user']],
  </code></pre>
  
  <ol start="5">
  <li>I am able to log in and read my user profile, but when trying to access <a href="http://localhost:5000/hello" rel="nofollow noreferrer">http://localhost:5000/hello</a> (protected), I'm getting the error the title of this question</li>
  </ol>
  
  <blockquote>
  <pre><code>{"name":"AzureAD: Bearer Strategy","hostname":"DESKTOP-NCVLN56","pid":20720,"level":30,"msg":"authentication failed due to: jwt audience is invalid","time":"2020-04-11T13:38:08.700Z","v":0}
  </code></pre>
  </blockquote>
  
  <p>--</p>
  
  <p>I can see the Bearer Token coming (in the UI and backend), the server decodes the token (I can see all my profile info in the server logs), but it's saying the JWT is invalid?! </p>
  
  <p>I'm not defining an audience, yet I can see in the token when it gets decoded the audience with <code>aud: 'api://clientId2'</code>.</p>
  
  <p>I can also see when the backend starts it shows the audience as <code>[clientId2, sps:clientId2]</code> by default (step4 on the backend). When I define in the config <code>audience: 'api://clientId2'</code>, I get a 403 with the message:</p>
  
  <blockquote>
  <pre><code>{"name":"AzureAD: Bearer Strategy","hostname":"DESKTOP-NCVLN56","pid":12644,"level":30,"msg":"In Strategy.prototype.jwtVerify: We did not pass Req back to Callback","time":"2020-04-11T16:19:30.398Z","v":0}
  </code></pre>
  </blockquote>
  
  <p>Any help would be appreciated. Thank you.</p>