microsoft/commercial-marketplace-client-dotnet

[DOC] Securing your webhooks doc doesn't contain expected claim

PFYasu opened this issue · 2 comments

PFYasu commented

Hello there,

I'm going through a documentation that described how to secure the Azure Marketplace SaaS Webhook.

Regarding to the doc:

"appid": "this is the resource id you use when you create publisher authorization token to call SaaS fulfillment APIs"

I've implemented a secure webhook as shown in the [documentation](https://microsoft.github.io/Mastering-the-Marketplace/saas/pdfs/10.3-simple-webhook-dotnet-securing.pdf). I didn't see the claim with the appid type.

Below I attached claims keys that were received from a webhook request header:

aud
iss
iat
exp
aio
azp
azpacr
oid
rh
sub
tid
uti
ver

I don't see appid there. Seems that has been changed to aud, right?

Hi @PFYasu - For this I recommend raising a support ticket on our partner center please.

PFYasu commented

Hi @santhoshb-msft. I wasn't sure where to raise this issue.
Thanks for your recommendation. I'll create a support ticket on the partner center, as you suggested.