How can I verify the issuer URL in JWT validation for Azure Logic Apps

1. Extract the Issuer Claim: First, decode the JWT token to extract the issuer claim. This claim should match the expected issuer URL for your Azure Logic App.

2. Configure Validation Parameters: Use the `TokenValidationParameters` class in .NET to specify the validation criteria. Set `ValidateIssuer` to `true` and provide the expected issuer URL(s) in the `ValidIssuers` array. For example, if your issuer is an Azure AD tenant, it might be in the format `https://sts.windows.net/{your-tenant-id}/` or `https://login.microsoftonline.com/{your-tenant-id}/`[7].

3. Validate the Token: Use a `JwtSecurityTokenHandler` to validate the token against the specified parameters. Ensure that `ValidateIssuerSigningKey` is set to `true` to verify the signature, which is crucial for security[6].

4. Azure Logic Apps Authorization Policy: In Azure Logic Apps, you can also create an authorization policy under the settings section. Add a new policy and specify the issuer claim for your tenant. This ensures that only tokens issued by the specified authority are accepted[7].

5. OpenID Configuration Endpoint: If your issuer supports OpenID Connect, you can use the `.well-known/openid-configuration` endpoint to dynamically retrieve the issuer's signing keys. This is particularly useful for validating tokens from different issuers[3][4].

Here is a simplified example of how you might validate a JWT token in .NET:

csharp
using System.IdentityModel.Tokens.Jwt;
using System.Security.Claims;

// Extract the JWT token from the request
var jwtToken = actionContext.Request.Headers.Authorization.Parameter;

// Define validation parameters
var validationParameters = new TokenValidationParameters
{
    ValidateIssuer = true,
    ValidateIssuerSigningKey = true,
    ValidateAudience = true,
    ValidateLifetime = true,
    ValidIssuers = new[] { "https://sts.windows.net/{your-tenant-id}/" },
    ValidAudiences = new[] { "your-audience" },
    IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes("your-secret-key"))
};

// Validate the token
var handler = new JwtSecurityTokenHandler();
SecurityToken validatedToken;
try
{
    handler.ValidateToken(jwtToken, validationParameters, out validatedToken);
}
catch (SecurityTokenException ex)
{
    // Handle validation failure
}

Replace `"your-tenant-id"`, `"your-audience"`, and `"your-secret-key"` with your actual Azure AD tenant ID, audience, and secret key or signing key.

For Azure Logic Apps, ensure that the issuer claim matches the expected issuer URL for your Azure AD tenant.

Citations:
[1] https://stackoverflow.com/questions/56017333/how-to-validate-jwt-token-from-different-issuer
[2] https://www.criipto.com/blog/jwt-validation-guide
[3] https://learn.microsoft.com/en-us/azure/api-management/validate-jwt-policy
[4] https://docs.gitlab.com/administration/auth/oidc/
[5] https://adityadeshpandeadi.wordpress.com/2020/07/23/authorization-for-azure-logic-apps-token-based/
[6] https://auth0.com/blog/how-to-validate-jwt-dotnet/
[7] https://gotoguy.blog/2020/12/31/protect-logic-apps-with-azure-ad-oauth-part-1-management-access/
[8] https://learn.microsoft.com/en-us/azure/logic-apps/logic-apps-securing-a-logic-app