Generate token fails for Azure app which is both client and API (client credentials workflow)

Question

We are not able to generate a token for an app which is at the same time offering an API and acts as a client for another app. We want to use the client credentials workflow in OAuth.

The app ApiAndClient has client credentials and the permission to use the api of app ApiApp. We granted the ApiAndClient app admin consent to use the api of ApiApp. We configured a redirect URI in ApiApp. When we want to issue a token for ApiAndClient, the following error message comes up:

{
  "error": "invalid_request",
  "error_description": "AADSTS501461: AcceptMappedClaims is only supported for a token audience matching the application GUID or an audience within the tenant's verified domains. Either change the resource identifier, or use an application-specific signing key.\r\nTrace ID: XXXXX\r\nCorrelation ID: XXXXXXXXX\r\nTimestamp: 2020-09-04 07:40:31Z",
  "error_codes": [
    501461
  ],
  "timestamp": "2020-09-04 07:40:31Z",
  "trace_id": "XXXXXX",
  "correlation_id": "XXXXXX"
}

We compared the settings of both ApiAndClient and ApiApp to other apps, where the token works. There is one difference in the ApiApp, it has"acceptMappedClaims" set to true, other api app have set to null. If we set that to null, the error message changes:

"AADSTS50146: This application is required to be configured with an application-specific signing key. It is either not configured with one, or the key has expired or is not yet valid.\r\nTrace ID: xxxxxx\r\nCorrelation ID: xxxxxxx\r\nTimestamp: 2020-09-04 08:15:26Z",

Setting it to false does not change anything.

We have the suspicion, that the client app which acts also as a api might be the problem.

Answer 1

Keep acceptMappedClaims as true.

Now that ApiAndClient is also used as an API app, you should click on Expose an API and Set the Application ID URI, which will be treated as the tenant's verified domain.