title: MSIS9649: Received invalid OAuth request. The 'assertion' parameter value is not a valid access token
body: <p>I am trying to implement ADFS4 - OAuth (OpenID connect) for authentication and webapp to webapi communication.</p>
  
  <p>I have configured ADFS application group accordingly and use OpenIdconnectauth pipeline in webapp for authentication. In order to call webapi, if I request accesstoken using just client credential grant, it works fine as I receive the valid access token and able to get to the api. However, the access token does not have any user details in it which I need it from the webapi end.</p>
  
  <p>So, then I tried by creating UserAssertion object from bootstrapcontext.token. But this time, when ever I request access token, I receive this error as mentioned in the title.</p>
  
  <p>Here is the code snippet:</p>
  
  <pre><code>AuthenticationContext authContext = null;
  AuthenticationResult result = null;
  authContext = new AuthenticationContext(Startup.authority, false);
  ClientCredential credential = new ClientCredential(Startup.clientId, Startup.appKey);
  string usercheck = User.Identity.Name; //For checking, returns username
  
  var bootstrapContext = ClaimsPrincipal.Current.Identities.First().BootstrapContext as System.IdentityModel.Tokens.BootstrapContext;
  string username = ClaimsPrincipal.Current.FindFirst(ClaimTypes.Upn) != null ? ClaimsPrincipal.Current.FindFirst(ClaimTypes.Upn).Value : ClaimsPrincipal.Current.FindFirst(ClaimTypes.Email).Value;
  string userAccessToken = bootstrapContext.Token;
  UserAssertion userAssertion = new UserAssertion(bootstrapContext.Token, "urn:ietf:params:oauth:grant-type:jwt-bearer", username);
  
  string accessToken = null;
  HttpClient httpClient = new HttpClient();
  
  try {
  //result = authContext.AcquireTokenAsync(Startup.apiResourceId, credential).Result; // This works fine but no user details in the token
   result = authContext.AcquireTokenAsync(Startup.apiResourceId, credential, userAssertion).Result;
  }
  </code></pre>
  
  <p>Here is how the Startup.ConfigureAuth(IAppBuilder app) looks like in both webapp and webapi:</p>
  
  <p>In webapp:</p>
  
  <pre><code>public void ConfigureAuth(IAppBuilder app)
  {
              app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);
  
              app.UseCookieAuthentication(new CookieAuthenticationOptions());
  
              app.UseOpenIdConnectAuthentication(
                  new OpenIdConnectAuthenticationOptions
                  {
                      ClientId = clientId,
                      AuthenticationType = OpenIdConnectAuthenticationDefaults.AuthenticationType,
  
                      MetadataAddress = metadataAddress,
                      PostLogoutRedirectUri = postLogoutRedirectUri,
                      RedirectUri = postLogoutRedirectUri,
                      TokenValidationParameters = new System.IdentityModel.Tokens.TokenValidationParameters()
                      {
                          SaveSigninToken = true
                      },
  
                      ResponseType = "code id_token",
                      Notifications = new OpenIdConnectAuthenticationNotifications
                      {
                          AuthenticationFailed = context =&gt;
                          {
                              context.HandleResponse();
                              context.Response.Redirect("/Error?message=" + context.Exception.Message);
                              return Task.FromResult(0);
                          }
                      }
                  });
  }
  </code></pre>
  
  <p>And in webapi:</p>
  
  <pre><code>public void ConfigureAuth(IAppBuilder app)
          {
              JwtSecurityTokenHandler.InboundClaimTypeMap.Clear();
              app.UseActiveDirectoryFederationServicesBearerAuthentication(
                  new ActiveDirectoryFederationServicesBearerAuthenticationOptions
                  {
                      MetadataEndpoint = ConfigurationManager.AppSettings["ida:AdfsMetadataEndpoint"],
                      TokenValidationParameters = new TokenValidationParameters() {
                          SaveSigninToken = true,
                          ValidAudience = ConfigurationManager.AppSettings["ida:Audience"]
                      }
                  });
          }
  </code></pre>
  
  <p>I reckon that the token that I am passing in to the userassertion is incorrect. But how can I fix this? Is there any other way which I can get the user details in to the access token. I really appreciate if anyone can help us to solve this issue?</p>
  
  <p>Thanks.</p>