Daemon console app calling Azure AD cant find AppRole (MSAL) - azure

Question

I have two applications registered in Azure, a REST API and daemon console application that calls the REST API.
The work flow is shown
Daemon console app --call for token using secret--> Azure AD
Daemon console app use the return token to call --> REST API.
I do get the token and correct AppRole is defined in REST API, with Admin consent.
however, when I try to call the REST API Daemon console app throws this error
Failed to call the web API: InternalServerError
Content: System.ArgumentException: Requested value 'ApplicationRole' was not found.
at System.Enum.TryParseByName(RuntimeType enumType, String originalValueString, ReadOnlySpan`1 value, Boolean ignoreCase, Boolean throwOnFailure, UInt64& result)
I followed the official MS documentation here
https://github.com/Azure-Samples/active-directory-dotnetcore-daemon-v2/tree/master/2-Call-OwnApi
I decoded the JWT token it has the role defined:
...
"oid": "xxxxx",
"rh": "xxxx",
"roles": [
"ApplicationRole"
],
...
The Manifest file of REST API
...
appRoles": [
{
"allowedMemberTypes": [
"Application"
],
"description": "Daemon apps in this role can consume the web api.",
"displayName": "ApplicationRole",
"id": "unique uid",
"isEnabled": true,
"lang": null,
"origin": "Application",
"value": "ApplicationRole"
}
],
...
The admin consent is also being granted to Daemon console App
API / Permissions name Type Description Admin consent require Status
IoT-Manager (1)
ApplicationRole Application ApplicationRole Yes Granted for XX
What could be wrong here ?
Update
I debug Daemon application I found out that the access token does not contain roles
...
AuthenticationResult result = null;
try
{
result = await app.AcquireTokenForClient(scopes)
.ExecuteAsync();
Console.ForegroundColor = ConsoleColor.Green;
Console.WriteLine("Token acquired \n");
Console.WriteLine(result.AccessToken);
Console.WriteLine("Token ExpireOn \n");
Console.WriteLine(result.ExpiresOn);
Console.ResetColor();
}
...
When I print the access token and decode it shows it has AppRoles, where When I debug the object AuthenticationResult result has no attribute for roles.

Answer 1

I've run the sample you provided and it worked well, I'll show my steps below.
Creating an azure ad app as the service. When registering the app, I only enter the name field and keep others the default.
Next I exposed an api in this application. Expose an API-> Add a scope-> keep the default application id url->save and continue-> edit my scope like below:
Add the role like screenshot below:
Creating another azure ad app as the client, only enter the name field too.
Create client secret and add api permission.
set the sample code, the appsetting.json file of each project are needed to modify, and the controller file in api project. The value needed to be changed in controller depends on the api. In my side, you can see the screenshot in step 5, it shows api://xxx/App.Role, so I set the value as App.Role.