"failed to get from node cache: invalid status code received from the userinfo endpoint (400)" error when using the OpenID Connect plugin with Azure AD

After configuring the Open ID Connect plugin to validate against Microsoft Azure AD, and calling an API with the access token, Kong rejects the request with an error;

"message": "Unauthorized"

Checking the Kong error log shows the below messages;

unable to verify bearer token (invalid issuer (https://sts.windows.net/tenant-id/) was specified for access token, https://login.microsoftonline.com/<tenant-id>/v2.0 was expected)

[openid-connect] failed to get from node cache: invalid status code received from the userinfo endpoint (400)

If the access token is decoded at https://jwt.io/, you can see the issuer details. For example;

"iss": "https://sts.windows.net/fa6xxxx-d29xxxxxxxx2ffbd3e39/"

The iss value is different from that configured in the plugin.

During the setup of the Application in Microsoft Azure, make sure the value of accessTokenAcceptedVersion in the manifest file of the Application is set to 2;

"accessTokenAcceptedVersion": 2

If accessTokenAcceptedVersion is set to null, the issuer assigned will be https://sts.windows.net/tenant-id/ rather than the expected https://login.microsoftonline.com//v2.0 and Kong will reject the call.