azure active directory - AADSTS5002710: Invalid JWT token: header is malformed

Question

I am trying to implement the "On-Behalf-Of" flow between my Client (ReactJS), Express + Node.js server (API), and Microsoft Graph.

So far I have requested an accessToken from microsoft (Client), and have made a request to my API.

I have ran into the error "AADSTS5002710: Invalid JWT token: header is malformed." when I try to make an Axios post request from my API to https://login.microsoftonline.com/tenantID/oauth2/v2.0/token

Full Error:
{ error: 'invalid_request', error_description: 'AADSTS5002710: Invalid JWT token: header is malformed. ' + 'Trace ID: 068a382b-6f83-40f6-b1b1-7134223f4500 ' + 'Correlation ID: f46a2c03-84e8-46b3-b9d6-467174befa0b ' + 'Timestamp: 2021-01-06 16:26:40Z', error_codes: [ 5002710 ], timestamp: '2021-01-06 16:26:40Z', trace_id: '068a382b-6f83-40f6-b1b1-7134223f4500', correlation_id: 'f46a2c03-84e8-46b3-b9d6-467174befa0b' }

The body of my request is according to the tutorial "https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-on-behalf-of-flow".

I am constantly getting the error above as the result from microsoft online servers.

I have made the original (Client) request with my own custom scope
api://54ee17f...cfe06/Access.Test

Answer 1

I follow the tutorial to use On-Behalf-Of flow in Postman. But it works well.

My steps here:

1. Add API permission of Web API B to Web API A

2. Request Web API A to get access token(assertion of next step) with auth code flow

GET

https://login.microsoftonline.com/{tenant}/oauth2/v2.0/authorize
?scope={like api://1108f6-xxxxxxx-9f622/test} openid
&redirect_uri={redirect_uri of Web API A}
&nonce=123
&client_id={client-id of Web API A}
&response_type=id_token token

3. Request Web API B to get the access token for Microsoft Graph API

POST

https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token
grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer
&client_id={client_id of Web API B}
&client_secret={client_secret}
&assertion={access token from previous step}
&scope=https://graph.microsoft.com/user.read offline_access
&requested_token_use=on_behalf_of

4. Call Microsoft Graph API, like GET https://graph.microsoft.com/v1.0/users.

You could decode your access token(assertion) in https://jwt.io/, and check the HEADER.