title: 401 error when authenticating to an Azure API App using AAD
body: <p>I have an API app that has been working fine with a Gateway Host and now that the gateway host is being deprecated I'm trying to follow the <a href="https://azure.microsoft.com/en-gb/documentation/articles/app-service-api-whats-changed/" rel="nofollow">Migration Guide</a>.  I've redeployed my service using the 2.8.1 SDK and can log into the service with a browser using AAD or a Microsoft account and use Swagger to test the service.  However, I'm trying to get a client to access the service using a ClientId and Secret.  The code is able to get the access token from AAD but I always get a 401 error whenever I try to access one of the service resources.</p>
  
  <p>When I debug the service I see the following in the log:</p>
  
  <pre><code>Microsoft.Azure.AppService.Authentication Verbose: 0 : Received request: GET https://[myService].azurewebsites.net/api/[myResource]
  Microsoft.Azure.AppService.Authentication Warning: 0 : JWT validation failed: IDX10214: Audience validation failed. Audiences: 'https://[myService].azurewebsites.net/'. Did not match:  validationParameters.ValidAudience: '[AAD ClientId]' or validationParameters.ValidAudiences: 'http://[myService].azurewebsites.net'.
  Microsoft.Azure.AppService.Authentication Information: 0 : Sending response: 401.71 Unauthorized
  The thread 0x3b00 has exited with code 0 (0x0).
  </code></pre>
  
  <p>What appears to be the issue is that the Audience presented with the request is https but the validParameters.ValidAudiences collection only contains http.</p>
  
  <p>I can't see any way of configuring the Audience and it appears that the http based audience is being set when Visual Studio 2015 creates the App Service.  Is there a way of manually editing the ValidAudience collection?</p>
  
  <p>For reference my client code is:</p>
  
  <pre><code>    private static void Main(string[] args)
      {
          string app_id_url = "https://[myService].azurewebsites.net/";
          string authority = "https://login.windows.net/[myDirectory].onmicrosoft.com/";
          string clientId = "[AAD ClientId]";
          string clientSecret = "[AAD Client Secret]";
          string apiBaseUrl = "https://[myService].azurewebsites.net/";
  
          string aadToken = GetTokenForApplication(authority, clientId, clientSecret, app_id_url);
  
          var apiClient = new HttpClient { BaseAddress = new Uri(apiBaseUrl) };
          apiClient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", aadToken);
          var apiResponse = apiClient.GetAsync(apiBaseUrl + @"api/[myResource]").Result;
          string apiResponseContent = apiResponse.Content.ReadAsStringAsync().Result;
          Console.WriteLine(apiResponseContent);
      }
  
      public static string GetTokenForApplication(string authority, string clientId, string clientSecret, string resourceUrl)
      {
          AuthenticationContext authenticationContext = new AuthenticationContext(authority, false);
          ClientCredential clientCred = new ClientCredential(clientId, clientSecret);
          AuthenticationResult authenticationResult = authenticationContext.AcquireToken(resourceUrl, clientCred);
          string token = authenticationResult.AccessToken;
          return token;
      }
  </code></pre>