On behalf of flow returns AADSTS50013 Assertion failed signature validation. Reason - The key was not found - azure-active-directory

Question

I have a Web API that needs to make calls to Microsoft Graph API on behalf of the user. I'm using the OBO flow as described here.
To get the access token, I'm posting to
POST - https://login.microsoftonline.com/<my-tenant-id>/oauth2/v2.0/token
grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer
&client_id=<my-client-id>
&client_secret=<my-client-secret>
&assertion=<user's access token>
&scope=https://graph.microsoft.com/files.readwrite.all
&requested_token_use=on_behalf_of
The call fails with the following message:
{
"error": "invalid_grant",
"error_description": "AADSTS50013: Assertion failed signature validation. [Reason - The key was not found.]\r\nTrace ID: fb813f8e-ce15-4d09-bbae-9db5e5195a00\r\nCorrelation ID: ecb4e087-5506-4224-8f11-72fbf574beac\r\nTimestamp: 2020-10-22 02:18:57Z",
"error_codes": [
50013
],
"timestamp": "2020-10-22 02:18:57Z",
"trace_id": "fb813f8e-ce15-4d09-bbae-9db5e5195a00",
"correlation_id": "ecb4e087-5506-4224-8f11-72fbf574beac",
"error_uri": "https://login.microsoftonline.com/error?code=50013"
}
Any ideas what I could be doing wrong?
In response to #Chauncy Zhou,
I have an Angular app with:
"#azure/msal-angular": "^1.0.0",
"msal": "1.3.3"
In app.module, MSAL is configured something like:
MsalModule.forRoot(
{
auth: {
clientId: environment.msClientId, // app1-client-id
authority: environment.msAuthorithy, // https://login.microsoftonline.com/<tenant-id>
redirectUri: environment.msRedirectUri // https://localhost:4200/callback
},
cache: {
cacheLocation: 'localStorage',
storeAuthStateInCookie: false
},
},
{
consentScopes: ['user.read', 'openid'],
protectedResourceMap: [
['https://app-2', ['api://app-2-id/scope-name']],
]
}
)
In a test component:
import { Component, OnInit } from '#angular/core';
import { MsalService } from '#azure/msal-angular';
#Component({
selector: 'app-test',
templateUrl: './test.component.html',
styleUrls: ['./test.component.scss']
})
export class TestComponent implements OnInit {
constructor(private msal: MsalService) {}
ngOnInit(): void {
this.msal.acquireTokenSilent({ scopes: ['api://app-2/scope-name'] }).then(response => {
console.log(response);
});
}
}
Take the access token from console, and do a POST for OBO in postman.

Answer 1

The error is &assertion.
You need to create two application,one is client application(test_1) and the other is web api application(test_2).
In the test_2 application,you need to expose an api.
And in the test_1 application,you need to give test_1 permission to access test_2.
The testing session.
First, use the ROPC grant flow to request access token for test_ 2 application
ropc grant flow
Note that the scope here is api://{test_2 application id}/.default.
Second,use OBO flow to request access token for microsoft graph api endpoint.
on-behalf-of flow