You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: support/entra/entra-id/app-integration/troubleshoot-wif10201-no-validkey-securitytoken-mvc.md
+11-11Lines changed: 11 additions & 11 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,6 +1,6 @@
1
1
---
2
-
title: ASP.NET MVC application error WIF10201 No valid key mapping found for securityToken
3
-
description: This article provides guidance for troubleshooting the the error "WIF10201- No valid key mapping found for securityToken".
2
+
title: ASP.NET MVC Application Error WIF10201 No Valid Key Mapping Found for SecurityToken
3
+
description: This article provides guidance for troubleshooting the error, "WIF10201- No valid key mapping found for securityToken."
4
4
author: genlin
5
5
ms.author: bachoang
6
6
ms.service: entra-id
@@ -9,18 +9,18 @@ ms.date: 02/05/2025
9
9
ms.custom: sap:Issues Signing In to Applications
10
10
---
11
11
12
-
# WIF10201: No valid key mapping found for securityToken in ASP.NET application
12
+
# "WIF10201: No valid key mapping found for securityToken" error in ASP.NET application
13
13
14
-
This article provides guidance for troubleshooting an authentication issue in an ASP.NET MVC application that uses both [WS-Federation](https://github.com/Azure-Samples/active-directory-dotnet-webapp-wsfederation) OWIN middleware and [Windows Identity Foundation](../../../windows-server/user-profiles-and-logon/windows-identity-foundation.md) (WIF) to authenticate to Microsoft Entra ID.
14
+
This article provides guidance for troubleshooting an authentication issue that occurs in an ASP.NET MVC application that uses both [WS-Federation](https://github.com/Azure-Samples/active-directory-dotnet-webapp-wsfederation) OWIN middleware and [Windows Identity Foundation](../../../windows-server/user-profiles-and-logon/windows-identity-foundation.md) (WIF) to authenticate to Microsoft Entra ID.
15
15
16
-
## Symptom
16
+
## Symptoms
17
17
18
-
The ASP.NET MVC application was working previously. However, the following error is now occurring without any changes to the application.
18
+
The ASP.NET MVC application that was previously working generates the following error message although no changes were made to the application:
19
19
20
20
```
21
21
Error Details:
22
22
Server Error in '/' Application.
23
-
WIF10201: No valid key mapping found for securityToken: ‘System.IdentityModel.Tokens.X509SecurityToken' and issuer: 'https://sts.windows.net/<Directory ID>/'.
23
+
WIF10201: No valid key mapping found for securityToken: 'System.IdentityModel.Tokens.X509SecurityToken' and issuer: 'https://sts.windows.net/<Directory ID>/'.
24
24
25
25
Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.
Windows Identity Foundation uses the certificate thumbprint(s) in the web.config file as shown below to verify the signature of the token returned by the Entra ID upon a successful sign-in.
32
+
To validate the signature of the token that's returned by the Entra ID after a successful sign-in, WIF uses the certificate thumbprints that are in the Web.config file, as shown in the following example:
The error WIF10201occurs when none of these certificate thumbprints match the one used by Entra ID to sign the token.
50
+
The "WIF10201" error occurs if none of these certificate thumbprints match the one that's used by Entra ID to sign the token.
51
51
52
-
The Entra ID uses a [signing key rollover mechanism](/entra/identity-platform/signing-key-rollover), which updates the certificate used to sign authentication tokens periodically. This key rollover causes the initial certificate thumbprints configured in the web.config file to become invalid, hence leading to the error.
52
+
The Entra ID uses a [signing key rollover mechanism](/entra/identity-platform/signing-key-rollover) to update the certificate that's used to sign authentication tokens periodically. This key rollover causes the initial certificate thumbprints that are configured in the Web.config file to become invalid.
53
53
54
54
## Solution
55
55
56
-
You can either update the certificate thumbprints in the web.config file manually or automate the process through code. For more information, see [Best practices for keys metadata caching and validation](/entra/identity-platform/signing-key-rollover#best-practices-for-keys-metadata-caching-and-validation).
56
+
You can either manually update the certificate thumbprints that are in the Web.config file or automate the process through code. For more information, see [Best practices for keys metadata caching and validation](/entra/identity-platform/signing-key-rollover#best-practices-for-keys-metadata-caching-and-validation).
0 commit comments