OnBehalfOfCredentials giving error due to missing x5c claim in the JWT header

[sasohail]

Getting below error even after setting the OnBehalfOfCredentialOptions.SendCertificateChain = true

MsalServiceException: A configuration issue is preventing authentication - check the error message from the server for details. You can modify the configuration in the application registration portal. See aka.ms/msal-net-invalid-client for details. exception: AADSTS700027: Client assertion contains an invalid signature. [Reason - The key was not found., Thumbprint of key used by client: '815C0F457ABD378599BC9310F9713C6DC581C74F',Please visit the Azure Portal, Graph Explorer or directly use MS Graph to see configured keys for app Id '7255edad-9269-44d0-b153-92ceffbf86fa'. Review the documentation at docs.microsoft.com/en-us/graph/deployments to determine the corresponding service endpoint and docs.microsoft.com/en-us/graph/api/… to build a query request URL, such as 'graph.microsoft.com/beta/applications/…. Alternatively, SNI may be configured on the app. Please ensure that client assertion is being sent with the x5c claim in the JWT header using MSAL's WithSendX5C() method so that Azure Active Directory can validate the certificate being used. Trace ID: 7aaf56e0-ca8d-48b6-8103-9de701ba6000 Correlation ID: 796539b1-465c-4552-84f7-b72468ed907d Timestamp: 2022-03-14 16:41:35Z

Same app works successfully with MSAL
var msalResult = await this.application.AcquireTokenOnBehalfOf(scopes, new Identity.Client.UserAssertion(userToken)).WithSendX5C(true).ExecuteAsync();
return msalResult.ToResult();

[azure-sdk]

Label prediction was below confidence level 0.6 for Model:ServiceLabels: 'Azure.Identity:0.45487067,KeyVault:0.23919488,Azure.Core:0.06016083'

[jsquire]

Thank you for your feedback. Tagging and routing to the team member best able to assist.

[christothes]

Hi @sasohail - Can you verify that the private key is present in the certificate being used by the OnBehalfOfCredential?

[sasohail]

@christothes. The private key is present. this works fine when using ClientCertificateCredentials.
Also we are able to do onBehalf flow using MSAL with same app id and certificate.

[christothes]

Thanks - this looks like a duplicate of #27679 - I'm working on a fix now.

[christothes]

closing as duplicate