title: How to integrate swagger with Azure Active Directory OAuth
body: <p>I'm trying to setup Swagger in my AspNetCore 2.1 application using Azure Active Directory V2 but I cannot seem to get it right. I am able to configure the setup so that swagger prompts, redirects and successfully authenticates my client/user but when passing the bearer token to the server results in the error <code>Bearer error=&quot;invalid_token&quot;, error_description=&quot;The signature is invalid&quot;</code>. I have created a GitHub repository with the project I am trying to get work with all its configuration (<a href="https://github.com/alucard112/auth-problem" rel="nofollow noreferrer">https://github.com/alucard112/auth-problem</a>)</p>
  <p>I have managed to get the V1 endpoint working, by setting the resource to the Client Id of the AAD app, which results in the JWT token having the 'aud' set to the app client Id. In the V2 endpoint the 'aud' is being set to what I think is the Graph API resource '00000003-0000-0000-c000-000000000000'. I believe this is my problem at the moment, although am not 100 % sure. The V2 endpoints don't seem to have a way to define the audience like the V1 did unless of course there is some oversight from my side.</p>
  <p>My Startup file is structured as follows:</p>
  <p>The authentication is setup as the following:</p>
  <pre><code>services.AddAuthentication(AzureADDefaults.BearerAuthenticationScheme)
                  .AddAzureADBearer(options =&gt; Configuration.Bind(&quot;AzureAd&quot;, options));
  
  
              services.Configure&lt;JwtBearerOptions&gt;(AzureADDefaults.JwtBearerAuthenticationScheme, options =&gt;
              {
                  options.Authority = $&quot;https://login.microsoftonline.com/{tenantId}&quot;;
                  options.TokenValidationParameters = new TokenValidationParameters
                  {
                      // In multi-tenant apps you should disable issuer validation:
                      ValidateIssuer = false,
                      // In case you want to allow only specific tenants,
                      // you can set the ValidIssuers property to a list of valid issuer ids
                      // or specify a delegate for the IssuerValidator property, e.g.
                      // IssuerValidator = (issuer, token, parameters) =&gt; {}
                      // the validator should return the issuer string
                      // if it is valid and throw an exception if not
                  };
              });
  </code></pre>
  <p>And the swagger is setup as follows:</p>
  <pre><code> services.AddSwaggerGen(c =&gt;
              {
                  c.SwaggerDoc(&quot;v1&quot;, new Info
                  {
                      Title = &quot;Protected Api&quot;,
                  });
  
                  c.OperationFilter&lt;SecurityRequirementsOperationFilter&gt;();
  
                  //IMATE - StevensW
                  // Define the OAuth2.0 scheme that's in use (i.e. Implicit Flow)
                  c.AddSecurityDefinition(&quot;oauth2&quot;, new OAuth2Scheme
                  {
                      Type = &quot;oauth2&quot;,
                      Flow = &quot;implicit&quot;,
                      AuthorizationUrl = $&quot;https://login.microsoftonline.com/{tenantId}/oauth2/v2.0/authorize&quot;,
                      TokenUrl = $&quot;https://login.microsoftonline.com/common/{tenantId}/v2.0/token&quot;,
                      Scopes = new Dictionary&lt;string, string&gt;
                     {
                         { &quot;openid&quot;, &quot;Unsure&quot; },
                         { &quot;profile&quot;, &quot;Also Unsure&quot; }
                     }
                  });
              });
  </code></pre>
  <pre><code> app.UseSwagger();
              app.UseSwaggerUI(c =&gt;
              {
                  c.SwaggerEndpoint(&quot;/swagger/v1/swagger.json&quot;, &quot;My API V1&quot;);
                  c.OAuthClientId(Configuration.GetValue&lt;string&gt;(&quot;AzureAd:ClientId&quot;));
                  c.OAuthAppName(&quot;Protected API&quot;);
  
                  // c.OAuthUseBasicAuthenticationWithAccessCodeGrant();
                  // NEVER set the client secret here. It will ve exposed in the html of the swagger page if you &quot;view source&quot; and its not needed for OpenID Auth
                  // c.OAuthClientSecret(Configuration.GetValue&lt;string&gt;(&quot;AzureAd:ClientId&quot;));
              });
  </code></pre>
  <p>I am hoping to configure the swagger UI to use AAD's V2 endpoint and allow for a multi-tenant login that allows successfully authenticated API calls to be executed. Any help or direction would be greatly appreciated.</p>