"Jwt is not in the form of Header.Payload.Signature with two dots and 3 sections" Similar to #342

I am running into this issue when enabling token authentication in api gateway. I have a grpc service in cloud run with api gateway configured fronting it. If I configure api gateway with no auth (allow_unregistered_calls=true) and I set the authorization header in the metadata, the call succeeds and I can see the token passed to the backend as x-forwarded-authorization and I can decode that token using jwt.io. The token is an Entra ID id_token.

When I modify the config to include auth:

authentication:
providers:
- id: entra_id
jwks_uri: https://login.microsoftonline.com/common/discovery/v2.0/keys
issuer: https://login.microsoftonline.com/tenanid/v2.0
audiences: clientid
rules:
- selector: '*'
requirements:
- provider_id: entra_id
- usage:
rules:
- selector: "*"
allow_unregistered_calls: false

I get the error in the title of this issue. The token clearly has the 3 segments as decodes fine in jwt.io. It seems this error is only returned when doing the parse so I'm at a loss as to what the issue could be. It would seem that the token being passed to jwt parse is not the correct token. I am making the call with metadata=(("authorization", f"Bearer {jwt}"). As mentioned, I can see this token being passed along as x-forwarded-authorization, so the gateway seems to be picking it up.

Start by reproducing the API Gateway authentication configuration with the gRPC authorization metadata and compare the original authorization value with x-forwarded-authorization. Trace where the token is parsed and determine why the valid three-section token is rejected; done means the cause is identified and the behavior is corrected or clearly documented.

Written by the indexing model from the issue text.