title: Azure AD Claims mapping requires custom signing key
body: <p>We're using application client credentials to authenticate via Azure AD.</p>
  
  <p>When we do this the <code>Identity.Name</code> is <code>null</code>. This is because there is no name claim mapped into the JWT.</p>
  
  <p>We discovered you can map custom claims, like so: <a href="https://docs.microsoft.com/en-us/azure/active-directory/active-directory-claims-mapping#claims-mapping-policy-type" rel="noreferrer">Claims mapping in Azure Active Directory</a>.</p>
  
  <p>When you apply the policy to the application, the next time you authenticate you receive an error: </p>
  
  <blockquote>
    <p>"AADSTS50146: This application is required to be configured with an application-specific signing key."</p>
  </blockquote>
  
  <p>Cool, there is a way out of this though: <a href="https://docs.microsoft.com/en-us/powershell/module/Azuread/New-AzureADApplicationKeyCredential?view=azureadps-2.0" rel="noreferrer">New-AzureADApplicationKeyCredential</a>.  It indicates you can create a Symmetric signing key in your application and voila -- we now have a JWT with the custom claim.</p>
  
  <p>The problem, not resolved: it generates a jwt with a HS256 header, not the required RS256 algorithm.</p>
  
  <p>When I try to authorize the jwt against the application. It fails, unauthorized.</p>
  
  <p>Now I am stuck, I can map a custom claim, but with no way to authorize the jwt :(</p>
  
  <p>I there a way to resolve this issue?</p>