Custom tokenhandler in MobileAppService, hosted at azure, not handling all the messaged - asp.net

Question

I have implemented my own JWT TokenHandler for the MobileAppService backend (ASP .Net, MVC).
The app service in ConfigureMobileApp is configured to use my custom TokenHandler instead of the AppServiceTokenHandler, like this:
public static void ConfigureMobileApp(IAppBuilder app)
{
....
HttpConfiguration httpConfig = new HttpConfiguration();
app.UseAppServiceAuthentication(new AppServiceAuthenticationOptions
{
SigningKey = ConfigurationManager.AppSettings["SigningKey"],
ValidAudiences = new[] { ConfigurationManager.AppSettings["ValidAudience"] },
ValidIssuers = new[] { ConfigurationManager.AppSettings["ValidIssuer"] },
TokenHandler = new TokenHandler() //httpConfig.GetAppServiceTokenHandler()
});
....
}
The custom TokenHandler is invoked, the JWT token is processed and the user is authorized. Everything is working perfectly fine. However, when I use the MobileServiceClient of my app to send messages, I see this exception being caught in the backend server log:
Microsoft.Azure.AppService.Authentication Warning: 0 : JWT validation failed: IDX10503: Signature validation failed. Keys tried: 'System.IdentityModel.Tokens.InMemorySymmetricSecurityKey
'.
Exceptions caught:
Since the exception is being caught, the application works fine. So what is happening is that the token is being sent simultaneously to both my custom TokenHandler and the default AppServiceTokenHandler. Since the JWT token has some claims which are not recognized by the default AppServiceTokenHandler, it throws (and catches) an exception.
Is there anyway I can force the AppServiceTokenHandler (or maybe other token handler which is there by default and I am not aware of) to be disabled?
Update:
Following Amor - MSFT's suggestion, I changed the code to what he proposed, setting the TokenHandler as
httpConfig.SetAppServiceTokenHandler(new TokenHandler());
but it didn't help. I also edited the web.config as follows, but it had no effect:
<system.identityModel>
<identityConfiguration>
<securityTokenHandlers>
<remove type="System.IdentityModel.Tokens.SessionSecurityTokenHandler, System.IdentityModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />
<remove type="System.IdentityModel.Services.Tokens.MachineKeySessionSecurityTokenHandler, System.IdentityModel.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />
<add type="MyApp.ASP.Handlers.TokenHandler, MyApp.ASP, Version=1.0.0.0, Culture=neutral" />
</securityTokenHandlers>
</identityConfiguration>
Also tried the following (as suggested here), still no effect:
<securityTokenHandlers>
<clear />
</securityTokenHandlers>

Answer 1

Is there anyway I can force the AppServiceTokenHandler (or maybe other token handler which is there by default and I am not aware of) to be disabled?
Please save your custom token handler to config.Properties before using it. We can invoke SetAppServiceTokenHandler method to do it.
var tokenHandler = new CustomTokenHandler();
httpConfig.SetAppServiceTokenHandler(tokenHandler);
Based on the document of AuthenticationHttpConfigurationExtensions.cs, SetAppServiceTokenHandler method will help us save the custom token handle to config.Properties and it will return the custom handle when the config.GetAppServiceTokenHandler method is invoked. Your final code could be like this,
HttpConfiguration httpConfig = new HttpConfiguration();
var tokenHandler = new CustomTokenHandler();
httpConfig.SetAppServiceTokenHandler(tokenHandler);
app.UseAppServiceAuthentication(new AppServiceAuthenticationOptions
{
// This middleware is intended to be used locally for debugging. By default, HostName will
// only have a value when running in an App Service application.
SigningKey = ConfigurationManager.AppSettings["SigningKey"],
ValidAudiences = new[] { ConfigurationManager.AppSettings["ValidAudience"] },
ValidIssuers = new[] { ConfigurationManager.AppSettings["ValidIssuer"] },
TokenHandler = httpConfig.GetAppServiceTokenHandler()
});
Edit 5/22/2017
Since you are using AppServiceAuthenticationMiddleware, please make sure you disabled the Authentication / Authorization in Azure portal.