Troubleshooting: AADSTS900561 Error When SecureAuth Is Configured as an External Authentication Method (EAM) in Entra ID

Version Affected: All
 
 

Overview

When SecureAuth Identity Platform (SAIDP) is configured as an External Authentication Method (EAM) in Microsoft Entra ID, users may intermittently see the following error during sign-in:

AADSTS900561: The endpoint only accepts POST requests. Received a GET request

Cause

This error is a generic symptom of the authentication flow between SAIDP and Entra ID being interrupted -- it does not by itself indicate where the interruption occurred. Enabling the realm's Debug log and reproducing the issue typically reveals the actual underlying failure, similar to the following:

Message="[JwtValidator].[ValidateJwt]: Exception: Microsoft.IdentityModel.Tokens.SecurityTokenSignatureKeyNotFoundException: IDX10501: Signature validation failed. Unable to match key: kid: '[PII is hidden. For more details, see https://aka.ms/IdentityModel/PII.]'. Exceptions caught: '[PII is hidden. For more details, see https://aka.ms/IdentityModel/PII.]'. token: '[PII is hidden. For more details, see https://aka.ms/IdentityModel/PII.]'.
   at System.IdentityModel.Tokens.Jwt.JwtSecurityTokenHandler.ValidateSignature(String token, TokenValidationParameters validationParameters)
   at System.IdentityModel.Tokens.Jwt.JwtSecurityTokenHandler.ValidateToken(String token, TokenValidationParameters validationParameters, SecurityToken& validatedToken)
   at SecureAuth.IdentityModel.OpenIDConnect.Validators.JwtValidator.ValidateJwt(String jwt, String audience, String issuer, SecurityKey securityKey, Boolean validateLifetime)"

This IDX10501 exception means SAIDP could not match the Key ID (kid) on the token Entra ID issued against any key Entra ID currently publishes -- a signature validation failure on Entra ID's own token, not a SAIDP configuration problem.

Resolution:

To confirm the signature-validation failure and gather what Microsoft Support will need:

1. Reproduce the issue with the realm's Debug log enabled, and confirm the log shows the IDX10501 signature-validation exception above.
2. Capture a HAR trace of the failed sign-in.
3. In the HAR trace, find the call to the EAM realm that immediately follows https://login.microsoftonline.com/common/federation/externalauthproviderredirect, and locate its id_token_hint parameter.
4. Decode that JWT and note the kid (Key ID) value from its header.
5. Get the tenant ID (tid) from the same HAR trace, then browse to https://login.microsoftonline.com/[tid]/discovery/keys to view the signing keys Entra ID currently publishes for that tenant.
6. Compare the kid from the token against the keys returned above. If it is not present, this confirms the failing signature validation is against a token issued and signed by Entra ID, not by SAIDP.
7. Entra ID's own sign-in and audit logs do not record this error, so once the above is confirmed, engage Microsoft Support to investigate further on the Entra ID side.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.