JWT with multiple aud values causes authentication error

milesokeefe — Thu, 15 May 2025 14:20:26 GMT

I have configured a virtual proxy in my Qlik Sense Enterprise for Windows instance with JWT authentication.

The JWT I am providing in the Authorization header is generated by Auth0, and as such has two values for audience:

"aud": [ "https://myapp.com", "https://anna-development.auth0.com/userinfo" ],

I have the expected aud value in the virtual proxy set to "https://myapp.com".

When attempting to authenticate with this JWT, Qlik logs this error:

Audit.Proxy.Proxy.SessionEstablishment.Authentication.JWT.JwtAuthenticationHandler [...] JWT contains aud claim with invalid value: System.Collections.ArrayList [..]

An array is a valid value for the aud field in a JWT.

Qlik's documentation even references this here (note that recipients is plural):

Audience (aud😞 Identifies the recipients of the token.

topic JWT with multiple aud values causes authentication error in Integration, Extension & APIs

JWT with multiple aud values causes authentication error