title: AzureAD JWT Token Audience claim prefix makes JWT Token invalid
body: <p>I'm using the 'adal-node' npm package to authenticate with an AzureAD. This is all working fine and I get a token back.</p>
  
  <p>However, the when examining the 'aud' claim in the JWT token I see the audience GUID is prefixed with 'spn:'. I think this is causing me problems when I try to use the JWT token on an already existing Web API. When I authenticate via a WebApp using the same AzureAD the 'aud' claim is NOT prefixed with 'spn:' and I am able to called endpoints on the WebAPI.</p>
  
  <p>Can anyone shed any light on this? This is last hurdle to get over after a lot of head banging getting this working.</p>
  
  <p>Update:</p>
  
  <p>Using the npm package 'azure-ad-jwt' to validate the JWT token with AzureAD as soon as I receive it gives me the error which I suspected is the problem - 'JWT audience is invalid'. It is expecting the 'aud' claim not to have the 'spn:' prefix. Where is this spn prefix coming from?</p>
  
  <p>Here's my app.js</p>
  
  <pre><code>var adal = require('adal-node');
  
  var activeDirectoryEndpointUrl = 'https://login.microsoftonline.com/';
  
  var options = {
      domain: '&lt;AzureAD GUID&gt;',
      activeDirectoryResourceId: '&lt;AzureAD App Client ID 1&gt;',
      clientId: '&lt;AzureAD App Client ID 2&gt;'
  };
  
  var tokenCache = new adal.MemoryCache();
  var authorityUrl = activeDirectoryEndpointUrl + options.domain;
  var context = new adal.AuthenticationContext(authorityUrl, true, tokenCache);
  
  context.acquireUserCode(options.activeDirectoryResourceId, options.clientId, 'en-us', function (err, userCodeResponse) {
      if (err) {
          console.error(err);
          return;
      }
  
      console.log('Use a web browser to open the page ' + userCodeResponse.verificationUrl + ' and enter the code ' + userCodeResponse.userCode + ' to sign in.');
  
      context.acquireTokenWithDeviceCode(options.activeDirectoryResourceId, options.clientId, userCodeResponse, function (err, tokenResponse) {
          if (err) {
              console.error(err);
              return;
          }
  
          console.log(tokenResponse);
      });
  });
  </code></pre>
  
  <p>Decoded JWT Token:</p>
  
  <pre><code>{
      "typ":"JWT",
      "alg":"RS256",
      "x5t":"XXXXXXX",
      "kid":"XXXXXXX"
  }
  {
      "aud":"spn:XXXXXXX",    // &lt;&lt;&lt; Offending claim
      "iss":"https://sts.windows.net/XXXXXXX/",
      "iat":1471355868,
      "nbf":1471355868,
      "exp":1471359768,
      "acr":"1",
      "amr":["pwd"],
      "appid":"XXXXXXX",
      "appidacr":"0",
      "e_exp":7200,
      "family_name":"XX",
      "given_name":"XX",
      "ipaddr":"XX.XX.XX.XX",
      "name":"XX XX",
      "oid":"XXXXXXX",
      "scp":"user_impersonation",
      "sub":"XXXXXXX",
      "tid":"XXXXXXX",
      "unique_name":"XXX@XXX.onmicrosoft.com",
      "upn":"XXX@XXX.onmicrosoft.com",
      "ver":"1.0"
  }
  </code></pre>