使用ADAL返回的令牌调用服务时出现未授权错误：Active Directory .Net Native Desktop？

Question

I'm trying to learn more about Azure Active Directory. I'm looking at the Code Samples at: https://azure.microsoft.com/en-us/documentation/articles/active-directory-code-samples/

The first sample I ran on my local is: NativeClient-DotNet, https://github.com/Azure-Samples/active-directory-dotnet-native-desktop .

I follow the steps, the ADAL returns the token successfully, see below screen shot.

However, when I use the token to call the to do list service, it always fails. The error is:

Status Code: 401, ReasonPhrase: Unauthorized... (see the 1st screen shot).

Anyone knows what issue this is? Since it is sample code, I guess maybe just something I miss.

Thanks

Answer 1

Following the direction given by @Saca's comment in the question... I pasted my token at jwt.celebb.net .

I found that the aud (audience) property had a mismatching value... :| I spent more than 2 hours to figure this out while fiddling with Azure Portal applications' settings and the code...

In my Web API I had this in Web.config :

<add key="ida:Audience" value="api://49111627-c20d-45b0-9823-d3bbd8689916" />

While in the Client Web.config I had this:

<add key="todo:TodoListResourceid" value="49111627-c20d-45b0-9823-d3bbd8689916" />

You see the mismatch... they're different. There's an extra api:// there and so I was getting the Unauthorized exception.