{"action":"opened","issue":{"url":"https://api.github.com/repos/AzureAD/azure-activedirectory-library-for-java/issues/67","labels_url":"https://api.github.com/repos/AzureAD/azure-activedirectory-library-for-java/issues/67/labels{/name}","comments_url":"https://api.github.com/repos/AzureAD/azure-activedirectory-library-for-java/issues/67/comments","events_url":"https://api.github.com/repos/AzureAD/azure-activedirectory-library-for-java/issues/67/events","html_url":"https://github.com/AzureAD/azure-activedirectory-library-for-java/issues/67","id":112366201,"number":67,"title":"Problem with on-behalf-of scenario","user":{"login":"wadamczewski","id":10187162,"avatar_url":"https://avatars.githubusercontent.com/u/10187162?v=3","gravatar_id":"","url":"https://api.github.com/users/wadamczewski","html_url":"https://github.com/wadamczewski","followers_url":"https://api.github.com/users/wadamczewski/followers","following_url":"https://api.github.com/users/wadamczewski/following{/other_user}","gists_url":"https://api.github.com/users/wadamczewski/gists{/gist_id}","starred_url":"https://api.github.com/users/wadamczewski/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wadamczewski/subscriptions","organizations_url":"https://api.github.com/users/wadamczewski/orgs","repos_url":"https://api.github.com/users/wadamczewski/repos","events_url":"https://api.github.com/users/wadamczewski/events{/privacy}","received_events_url":"https://api.github.com/users/wadamczewski/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-10-20T13:16:18Z","updated_at":"2015-10-20T13:16:18Z","closed_at":null,"body":"I am trying to use a JWT token that I have already obtained from an authenticated user (and passed to back-end from front-end) to use in the on-behalf-of scenario as follows:\r\n\r\n```\r\nprivate static AuthenticationResult getAccessTokenOnBehalfOfUser(String resourceId, String tenant, String clientId, String clientSecret, String userJwtToken) throws MalformedURLException, ServiceUnavailableException, ExecutionException, InterruptedException {\r\n\r\n        ClientCredential clientCredential = new ClientCredential(clientId, clientSecret);\r\n        ClientAssertion clientAssertion = new ClientAssertion(userJwtToken);\r\n\r\n        AuthenticationContext context = null;\r\n        AuthenticationResult result = null;\r\n        ExecutorService service = null;\r\n        try {\r\n            service = Executors.newFixedThreadPool(1);\r\n            context = new AuthenticationContext(\"https://login.microsoftonline.com/\" + tenant, true, service);\r\n\r\n            Future<AuthenticationResult> future = context.acquireToken(\r\n                    resourceId, clientAssertion, clientCredential,\r\n                    null);\r\n\r\n            result = future.get();\r\n        } finally {\r\n            service.shutdown();\r\n        }\r\n\r\n        if (result == null) {\r\n            throw new ServiceUnavailableException(\"authentication result was null\");\r\n        }\r\n        return result;\r\n    }\r\n```\r\n\r\nBut I keep getting an error: \r\n> {\"error_description\":\"AADSTS70002: Error validating credentials. AADSTS50013: Assertion audience claim does not match the required value.\\r\\nTrace ID: 0de7c901-7f0b-4c8d-8e0c-16c94dbdd35f\\r\\nCorrelation ID: 7cbdc1ec-2ba8-4116-939f-575680d29934\\r\\nTimestamp: 2015-10-20 13:07:20Z\",\"error\":\"invalid_grant\"}"}}