title: ADFS Client credentials grant flow with mulitple clients in an application group
body: <p><strong>SETTUP:</strong><br />
  We have an application which needs to authenticate itself to an API with help of ADFS. For this it seems suitable to use Client Credentials Grant Flow;<br />
  <a href="https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/overview/ad-fs-openid-connect-oauth-flows-scenarios#client-credentials-grant-flow" rel="nofollow noreferrer">https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/overview/ad-fs-openid-connect-oauth-flows-scenarios#client-credentials-grant-flow</a></p>
  <p>So in ADFS I created a new application group with a server application and a Web API with the following setup,</p>
  <p>Server Application:</p>
  <ul>
  <li>Client Id: client1</li>
  <li>Client Secret: (some-guid)</li>
  </ul>
  <p>Web API:</p>
  <ul>
  <li>Relying parties: client1</li>
  <li>Access control policy: Permit everyone</li>
  <li>Client permmissions --&gt; Client Application: client1</li>
  <li>Permitted scopes: openid profile allatclaim</li>
  </ul>
  <p>Then I request a token via https://.../adfs/oauth2/token with</p>
  <pre><code>client_id=client1
  client_secret=(some-guid) 
  grant_type=client_credentials
  </code></pre>
  <p>I received a JWT token with aud and appid as expected:</p>
  <pre><code>&quot;aud&quot;: &quot;microsoft:identityserver:client1&quot;
  &quot;appid&quot;: &quot;client1&quot;
  </code></pre>
  <p><strong>PROBLEM:</strong><br />
  The problem becomes when I want to add another client to use with the API. So I change my setup to,</p>
  <p>Server Application 1:</p>
  <ul>
  <li>Client Id: client1</li>
  <li>Client Secret: (some-guid)</li>
  </ul>
  <p>Server Application 2:</p>
  <ul>
  <li>Client Id: client2</li>
  <li>Client Secret: (some-guid)</li>
  </ul>
  <p>Web API:</p>
  <ul>
  <li>Relying parties: client1, client2</li>
  <li>Access control policy: Permit everyone</li>
  <li>Client permmissions --&gt; Client Application: client1, client2</li>
  <li>Permitted scopes: openid profile allatclaim</li>
  </ul>
  <p>Then when I request a JWT token with the credentials of client2 (client_id and client_secret) I get:</p>
  <pre><code>&quot;aud&quot;: &quot;microsoft:identityserver:client1&quot;
  </code></pre>
  <p>and the same if I use client1. I tried to add different relying parties in the Web API and it seems like it always sets the aud in the JWT to the first RP in the list (alphabetic order). For instance, if I also add 123 as a RP in the Web API then the &quot;aud&quot; becomes &quot;microsoft:identityserver:123&quot; for both client1 and client2.</p>
  <p>If I instead remove all relying parties and add a the url to my api then the aud in JWT token becomes &quot;urn:microsoft:userinfo&quot;.</p>
  <p>From what I have read, the aud field in the JWT token should contain all principals who will process the JWT token. See <a href="https://www.rfc-editor.org/rfc/rfc7519#section-4.1.3" rel="nofollow noreferrer">https://www.rfc-editor.org/rfc/rfc7519#section-4.1.3</a>.</p>
  <p><strong>QUESTIONS:</strong><br />
  How should a setup my Application group to be able to have multiple clients?<br />
  Can ADFS sent multiple audiences instead of only the first one?<br />
  Or have I used the wrong approach?</p>
  <p>Kind regards, Jesper</p>