title: Secure ASP.Net Core 3.1 API with Bearer Tokens from Azure AD
body: <p>I have a .net core 3.1 web API.  I want to secure the endpoints using bearer tokens from Azure AD.</p>
  
  <p>I have followed <a href="https://dotnetplaybook.com/secure-a-net-core-api-using-bearer-authentication" rel="nofollow noreferrer">This guide</a>.  I have a registered an app for the API and an app for the client.</p>
  
  <p>In my API, I have added a registration for the jwt (as outlined in the code)</p>
  
  <pre><code>services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
      .AddJwtBearer(opt =&gt;
      {
          opt.Audience = Configuration["AzureAd:ResourceId"];
          opt.Authority = $"{Configuration["AzureAd:Instance"]}{Configuration["AzureAd:TenantId"]}";
      });
  </code></pre>
  
  <p>And my configuration section for the API looks like this</p>
  
  <pre><code>"AzureAd": {
      "ResourceId": "api://&lt;client-id-guid&gt;",
      "Instance": "https://login.microsoftonline.com/",
      "TenantId": "&lt;tenant-id-guid&gt;"
  }
  </code></pre>
  
  <p>where the <code>client-id-guid</code> is the client id of the api application (used the default configuration for the api:// address).</p>
  
  <p>Then, for my client, I implemented a test in a new solution to get the token and call a secured endpoint.</p>
  
  <pre><code>AadConfiguration config = AadConfiguration.ReadFromJsonFile("appsettings.json");
  
  IConfidentialClientApplication app;
  
  app = ConfidentialClientApplicationBuilder.Create(config.ClientId)
      .WithClientSecret(config.ClientSecret)
      .WithAuthority(new Uri(config.Authority))
      .Build();
  
  string[] ResourceIds = new string[] {config.ResourceID};
  
  var token = await app.AcquireTokenForClient(ResourceIds)
      .ExecuteAsync();
  
  Assert.IsFalse(string.IsNullOrWhiteSpace(token.AccessToken));
  
  var request = new RestRequestBuilder("https://my-api-staging.azurewebsites.net/api")
      .WithSegments("health-check", "auth")
      .WithBearerToken(token.AccessToken)
      .Build();
  
  try
  {
      var response = await _restHelper.GetJsonAsync&lt;dynamic&gt;(request);
  
      Assert.IsFalse(string.IsNullOrEmpty(response?.serverTime?.ToString()));
  }
  catch (RestException e)
  {
      Assert.IsFalse(true, e.ResponseContent);
  }
  </code></pre>
  
  <p>And the configuration for this test</p>
  
  <pre><code>{
      "Instance": "https://login.microsoftonline.com/{0}",
      "TenantId": "&lt;tenant-id-guid&gt;",
      "ClientId": "&lt;client-id-guid&gt;",
      "ClientSecret": "&lt;client-secret&gt;",
      "ResourceId": "api://&lt;api-client-id-guid&gt;/.default"
  }
  </code></pre>
  
  <p>Tenant Id is the sale for both the API and the test application</p>
  
  <p>The client ID is the client id for the client app registration, and its secret</p>
  
  <p>The resource Id is the API's application id, which is the api:// with the api's client Id</p>
  
  <p>I can retrieve the access token just fine.  However, when I call an endpoint using the access token I am given, I get the following error:</p>
  
  <blockquote>
    <p>Couldn't find a valid certificate with subject 'CN=TODO.azurewebsites.net' on the 'CurrentUser\My'</p>
  </blockquote>
  
  <p>I'm not sure why my authentication is failing when I have followed the steps in the document.</p>