[SecurityTokenException: Invalid issuer or signature.]

Question

We have an provider hosted app running in Share Point Online which connects to Azure WebApp Service. The App worked fine for a while and it started to fail after sometime with following error.

[SecurityTokenException: Invalid issuer or signature.]
   Microsoft.IdentityModel.S2S.Tokens.JsonWebSecurityTokenHandler.VerifySignature(String signingInput, String signature, String algorithm, SecurityToken signingToken) +876
   Microsoft.IdentityModel.S2S.Tokens.JsonWebSecurityTokenHandler.ReadTokenCore(String token, Boolean isActorToken) +538
   Microsoft.IdentityModel.S2S.Tokens.JsonWebSecurityTokenHandler.ReadToken(String token) +7
   ProcessWeb.TokenHelper.ReadAndValidateContextToken(String contextTokenString, String appHostName) +32
   ProcessWeb.SharePointAcsContextProvider.CreateSharePointContext(Uri spHostUrl, Uri spAppWebUrl, String spLanguage, String spClientTag, String spProductNumber, HttpRequestBase httpRequest) +103
   ProcessWeb.SharePointContextProvider.CreateSharePointContext(HttpRequestBase httpRequest) +367
   ProcessWeb.SharePointContextProvider.GetSharePointContext(HttpContextBase httpContext) +106
   ProcessWeb.SharePointContextProvider.CheckRedirectionStatus(HttpContextBase httpContext, Uri& redirectUrl) +40
   ProcessWeb.SharePointContextFilterAttribute.OnActionExecuting(ActionExecutingContext filterContext) in E:\VSTSBuilds\Agent2\539\s\Dev\Code\Process\Process\ProcessWeb\Filters\SharePointContextFilterAttribute.cs:20
   System.Web.Mvc.Async.AsyncInvocationWithFilters.InvokeActionMethodFilterAsynchronouslyRecursive(Int32 filterIndex) +176
   System.Web.Mvc.Async.AsyncInvocationWithFilters.InvokeActionMethodFilterAsynchronouslyRecursive(Int32 filterIndex) +651
   System.Web.Mvc.Async.AsyncInvocationWithFilters.InvokeActionMethodFilterAsynchronouslyRecursive(Int32 filterIndex) +651
   System.Web.Mvc.Async.<>c__DisplayClass33.<BeginInvokeActionMethodWithFilters>b__31(AsyncCallback asyncCallback, Object asyncState) +58
   System.Web.Mvc.Async.WrappedAsyncResult`1.CallBeginDelegate(AsyncCallback callback, Object callbackState) +14
   System.Web.Mvc.Async.WrappedAsyncResultBase`1.Begin(AsyncCallback callback, Object state, Int32 timeout) +128
   System.Web.Mvc.Async.AsyncControllerActionInvoker.BeginInvokeActionMethodWithFilters(ControllerContext controllerContext, IList`1 filters, ActionDescriptor actionDescriptor, IDictionary`2 parameters, AsyncCallback callback, Object state) +197
   System.Web.Mvc.Async.<>c__DisplayClass21.<BeginInvokeAction>b__19(AsyncCallback asyncCallback, Object asyncState) +743
   System.Web.Mvc.Async.WrappedAsyncResult`1.CallBeginDelegate(AsyncCallback callback, Object callbackState) +14
   System.Web.Mvc.Async.WrappedAsyncResultBase`1.Begin(AsyncCallback callback, Object state, Int32 timeout) +128
   System.Web.Mvc.Async.AsyncControllerActionInvoker.BeginInvokeAction(ControllerContext controllerContext, String actionName, AsyncCallback callback, Object state) +328
   System.Web.Mvc.Controller.<BeginExecuteCore>b__1c(AsyncCallback asyncCallback, Object asyncState, ExecuteCoreState innerState) +25
   System.Web.Mvc.Async.WrappedAsyncVoid`1.CallBeginDelegate(AsyncCallback callback, Object callbackState) +30
   System.Web.Mvc.Async.WrappedAsyncResultBase`1.Begin(AsyncCallback callback, Object state, Int32 timeout) +128
   System.Web.Mvc.Controller.BeginExecuteCore(AsyncCallback callback, Object state) +556
   System.Web.Mvc.Controller.<BeginExecute>b__14(AsyncCallback asyncCallback, Object callbackState, Controller controller) +18
   System.Web.Mvc.Async.WrappedAsyncVoid`1.CallBeginDelegate(AsyncCallback callback, Object callbackState) +20
   System.Web.Mvc.Async.WrappedAsyncResultBase`1.Begin(AsyncCallback callback, Object state, Int32 timeout) +128
   System.Web.Mvc.Controller.BeginExecute(RequestContext requestContext, AsyncCallback callback, Object state) +420
   System.Web.Mvc.Controller.System.Web.Mvc.Async.IAsyncController.BeginExecute(RequestContext requestContext, AsyncCallback callback, Object state) +16
   System.Web.Mvc.MvcHandler.<BeginProcessRequest>b__4(AsyncCallback asyncCallback, Object asyncState, ProcessRequestState innerState) +52
   System.Web.Mvc.Async.WrappedAsyncVoid`1.CallBeginDelegate(AsyncCallback callback, Object callbackState) +30
   System.Web.Mvc.Async.WrappedAsyncResultBase`1.Begin(AsyncCallback callback, Object state, Int32 timeout) +128
   System.Web.Mvc.MvcHandler.BeginProcessRequest(HttpContextBase httpContext, AsyncCallback callback, Object state) +369
   System.Web.Mvc.MvcHandler.BeginProcessRequest(HttpContext httpContext, AsyncCallback callback, Object state) +48
   System.Web.Mvc.MvcHandler.System.Web.IHttpAsyncHandler.BeginProcessRequest(HttpContext context, AsyncCallback cb, Object extraData) +16
   System.Web.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() +105
   System.Web.HttpApplication.ExecuteStepImpl(IExecutionStep step) +50
   System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously) +163

By executing below command we identified that the Client Secret had expired

Get-MsolServicePrincipalCredential -AppPrincipalID "

We created a new Client Secret and used that in the web.config file of the Remote Web, but the issue persisted.

We used below command to remove all the client secrets which were already available including the expired one.

Remove-MsolServicePrinicipal -AppPrincipalId "" -KeyIds ""

We created a new client secret which is valid for 3 years and added it to the web.config file and waited for more than 8 hrs, but still issue persists.

Can anyone know why this is happening whilst updated the web.config with a new client secret?

Thanks!!

Answer 1

Go to the visual studio solution and correct the Client Id/Secret in the web.config file and the publishing profile and finally deploy a new version of the app component - the issue should be resolved.

Possible Reason for the above error?

If you deploy the app from the development environment to the production but forget to correct the Client Id and Client Secret to the values that had previously been generated for production. This means that when the user is redirected to the production azure website the client details in SharePoint Online, in this case from the development environment, will not match with the already configured keys in the associated Azure web site and the end result might be the above error.

Refer to the below article for the detailed description:

Provider Hosted App Error – Invalid issuer or signature