title: Invalid passport authentication even after sending right token of Microsoft Graph
body: <p>I've a Node.js API which is protected using passport-azure-ad's BearerStrategy.</p>
  
  <p>I've another Client App which provides me a token to access Microsoft Graph.
  I've used that token to access Microsoft Graph and its working properly.</p>
  
  <p>But when I use the same token to authenticate in my API its throwing me this error.</p>
  
  <p>Response body: Unauthorized
  Response status: 401</p>
  
  <p>This is my configuration of passport to protect the API</p>
  
  <pre><code>const express = require('express');
  const bodyParser = require('body-parser');
  const morgan = require('morgan');
  const passport = require('passport');
  const OIDCBearerStrategy = require('passport-azure-ad').BearerStrategy;
  
  const app = express();
  
  app.use(bodyParser.json({ limit: '50mb' }));
  app.use(bodyParser.urlencoded({ extended: true }));
  app.use(morgan(':method :url :date :remote-addr :status :response-time'));
  app.use(passport.initialize());
  app.use(passport.session());
  
  const passportConfiguration = {
    clientID: &lt;&lt;&lt;Application ID&gt;&gt;&gt;,
    identityMetadata: 'https://login.microsoftonline.com/&lt;&lt;&lt;Tenant ID&gt;&gt;&gt;/.well-known/openid-configuration',
    audience: 'https://graph.microsoft.com', // I've even tried setting this to my App ID URI of Application registration
    validateIssuer: true, // if you have validation on, you cannot have users from multiple tenants sign in
    passReqToCallback: false,
    loggingLevel: 'info',
  };
  
  const OIDCStrategy = new OIDCBearerStrategy(passportConfiguration, (token, done) =&gt; {
    console.log('Verifying the User...');
    console.log('Access Token:', token);
  
    done(null, token);
  });
  
  passport.use(OIDCStrategy);
  
  app.get('/', (req, res) =&gt; {
    res.status(200).send('Welcome!');
  });
  
  app.get('/users', passport.authenticate('oauth-bearer', {
    session: false,
  }), (req, res) =&gt; {
    res.status(200).send('Take users...');
  });
  
  app.listen(8082, () =&gt; {
    console.log('App is running on http://localhost:8082');
  });
  </code></pre>
  
  <p>So when I hit the homepage '/' it's showing the proper response as it's not covered with the security layer of passport.</p>
  
  <p>But when I hit <a href="http://localhost:8082/users" rel="nofollow noreferrer">http://localhost:8082/users</a>
  with header: 
  Authorization: Bearer &lt;&lt;>></p>
  
  <p>It's returning Unauthorized with status 401.
  But I've tried to access Microsoft Graph using same token and I'm getting the response.</p>
  
  <p>These are the passsport log:</p>
  
  <pre><code>{"name":"AzureAD: Metadata Parser","hostname":"Deadman-INC","pid":5036,"level":30,"msg":"Parsing JSON retreived from the endpoint","time":"2019-01-15T07:54:36.374Z","v":0}
  {"name":"AzureAD: Metadata Parser","hostname":"Deadman-INC","pid":5036,"level":30,"msg":"Request to update the Open ID Connect Metadata","time":"2019-01-15T07:54:36.378Z","v":0}
  {"name":"AzureAD: Bearer Strategy","hostname":"Deadman-INC","pid":5036,"level":30,"msg":"In Strategy.prototype.authenticate: received metadata","time":"2019-01-15T07:54:36.637Z","v":0}
  {"name":"AzureAD: Bearer Strategy","hostname":"Deadman-INC","pid":5036,"level":30,"msg":"In Strategy.prototype.authenticate: we will validate the options","time":"2019-01-15T07:54:36.640Z","v":0}
  {"name":"AzureAD: Bearer Strategy","hostname":"Deadman-INC","pid":5036,"level":30,"msg":"In Strategy.prototype.authenticate: access_token is received from request header","time":"2019-01-15T07:54:36.643Z","v":0}
  {"name":"AzureAD: Bearer Strategy","hostname":"Deadman-INC","pid":5036,"level":30,"msg":"In Strategy.prototype.jwtVerify: token is decoded","time":"2019-01-15T07:54:36.649Z","v":0}
  {"name":"AzureAD: Metadata Parser","hostname":"Deadman-INC","pid":5036,"level":30,"msg":"working on key","time":"2019-01-15T07:54:36.655Z","v":0}
  {"name":"AzureAD: Bearer Strategy","hostname":"Deadman-INC","pid":5036,"level":30,"msg":"PEMkey generated","time":"2019-01-15T07:54:36.666Z","v":0}
  {"name":"AzureAD: Bearer Strategy","hostname":"Deadman-INC","pid":5036,"level":30,"msg":"authentication failed due to: In Strategy.prototype.jwtVerify: cannot verify token","time":"2019-01-15T07:54:36.675Z","v":0}
  </code></pre>
  
  <p>Could anyone help me out in this?</p>