# REST Service with Authentication with external Identity provider Azure AD **URL:** \ **Category:** General\ **Tags:** 8-7-6, manufacturing, lead-system-architect, security, pega-platform\ **Created:** [November 21, 2025, 10:37am UTC](https://forums.pega.com/t/rest-service-with-authentication-with-external-identity-provider-azure-ad/10258 "2025-11-21T10:37:43Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![RajeshKumarY6297](https://avatars.discourse-cdn.com/v4/letter/r/49beb7/32.png) [@RajeshKumarY6297](https://forums.pega.com/u/RajeshKumarY6297)\ **Post date:** [November 21, 2025, 10:37am UTC](https://forums.pega.com/t/rest-service-with-authentication-with-external-identity-provider-azure-ad/10258/1 "2025-11-21T10:37:43Z")
Hi Team, In our project we are developing a couple of REST services. For all these services we are planning to authenticate the callers by using Azure AD. Azure AD is used as enterprise-wide identity provider. To achieve this, in service package of Rest service we set Auth type as “Custom”. We created a token-based Authentication service. In this Auth service, we configure Identity mapping rule and in Identity mapping rule I have referred a token profile rule. I have verified with my Security team that all details in these rules are correct. When I say details, I mean Issuer, Audience, Key store etc. After doing all these, when we call our REST web service from PostMan we see 401 (Unauthenticated) response and in Log file we get below error. **Custom authentication service invalid, an Authentication Activity is required in the Data-Admin-AuthService instance ‘APRIntAuthService’** I am not sure where should I provide Authentication activity, in my Auth service I see only Pre Auth and Post Auth activity placeholder. I already referred these post - [Service REST OAuth2 - External OAuth2 Provider | Support Center](https://support.pega.com/question/service-rest-oauth2-external-oauth2-provider?) [Securing Service-Rest with external oAuth provider like Okta | Support Center](https://support.pega.com/question/securing-service-rest-external-oauth-provider-okta) ---
**Author:** ![RajeshKumarY6297](https://avatars.discourse-cdn.com/v4/letter/r/49beb7/32.png) [@RajeshKumarY6297](https://forums.pega.com/u/RajeshKumarY6297)\ **Post date:** [November 21, 2025, 12:35pm UTC](https://forums.pega.com/t/rest-service-with-authentication-with-external-identity-provider-azure-ad/10258/2 "2025-11-21T12:35:55Z")
@DavidElvar I see a post where you gave reply on the similar query. May I ask your advice on above query as well. Thanks, in advice David. Rajesh ---
**Author:** ![RajeshKumarY6297](https://avatars.discourse-cdn.com/v4/letter/r/49beb7/32.png) [@RajeshKumarY6297](https://forums.pega.com/u/RajeshKumarY6297)\ **Post date:** [November 26, 2025, 1:55pm UTC](https://forums.pega.com/t/rest-service-with-authentication-with-external-identity-provider-azure-ad/10258/3 "2025-11-26T13:55:11Z")
@DionLammers can you please help on this issue, Thanks in advance. ---
**Author:** ![DionLammers](https://yyz2.discourse-cdn.com/pega/user_avatar/forums.pega.com/dionlammers/32/7249_2.png) [@DionLammers](https://forums.pega.com/u/DionLammers)\ **Post date:** [November 27, 2025, 4:52pm UTC](https://forums.pega.com/t/rest-service-with-authentication-with-external-identity-provider-azure-ad/10258/4 "2025-11-27T16:52:52Z")
@RajeshKumarY6297In Pega, when you set the **Service Package Auth type** to **Custom** , the linked **Authentication Service** must also be a **Custom Authentication Service** , not just a token-based one. Token-based authentication is typically used for OAuth 2.0 or JWT validation, but if you choose “Custom” in the service package, Pega expects an **Authentication Activity** to be defined in the Authentication Service rule. If you want to use Azure AD with JWT/OAuth 2.0, try to use **OAuth 2.0 Authentication Profile** and configure the service package to use **OAuth 2.0** instead of “Custom”. If you want to stick with Custom Authentication, then: - Create an **Authentication Activity** in `Code-Security` class. - This activity should: - Validate the JWT token (e.g., using `pxProcessJWT`). - Set `pyIsAuthenticated = true` and operator context. - Fail gracefully if validation fails. - Reference this activity in the **Custom Authentication Activity** field of your Authentication Service ---
**Author:** ![RajeshKumarY6297](https://avatars.discourse-cdn.com/v4/letter/r/49beb7/32.png) [@RajeshKumarY6297](https://forums.pega.com/u/RajeshKumarY6297)\ **Post date:** [December 2, 2025, 7:57am UTC](https://forums.pega.com/t/rest-service-with-authentication-with-external-identity-provider-azure-ad/10258/5 "2025-12-02T07:57:20Z")
@DionLammers As you suggested we setup rules as below. Service Package set to Auth Type - Custom. Created Custom Authentication Service. Configured Timeout and Authentication activity. In Authentication activity we call **pxProcessJWT** (OOTB) to validate the JWT. This activity is validating the token without any issue. After we invoke service from Postman, we see error in log file - **.PRRuntimeException: No failure response set by custom authentication activity** To work around this, we are setting - Param.pyFailMessage and Param.pyStatus parameters. Both of these parameters are defined as OUT parameter of the Authentication activity But still Pega shows error in log - **No failure response set by custom authentication activity**. Please suggest some work around for this. Thanks in advance- Rajesh **Pega Version - 8.6.1** [Pega Log file 02 Dec.txt](https://forums.pega.com/uploads/short-url/4kI4GJ4TT96VhSwaJx97VLLmvvS.txt) (52.9 KB) [Auth Issue Data Pega.docx](https://forums.pega.com/uploads/short-url/7DPjyUvVT7nqBlLuzs8prQOyzKG.docx) (405 KB) ---
**Author:** ![RajeshKumarY6297](https://avatars.discourse-cdn.com/v4/letter/r/49beb7/32.png) [@RajeshKumarY6297](https://forums.pega.com/u/RajeshKumarY6297)\ **Post date:** [December 3, 2025, 6:53am UTC](https://forums.pega.com/t/rest-service-with-authentication-with-external-identity-provider-azure-ad/10258/6 "2025-12-03T06:53:29Z")
@DionLammers thanks a ton sir! I set operator context like you mentioned and it worked. Marking your reply as “Accepted Solution.” ---
**Author:** ![DionLammers](https://yyz2.discourse-cdn.com/pega/user_avatar/forums.pega.com/dionlammers/32/7249_2.png) [@DionLammers](https://forums.pega.com/u/DionLammers)\ **Post date:** [December 2, 2025, 10:26am UTC](https://forums.pega.com/t/rest-service-with-authentication-with-external-identity-provider-azure-ad/10258/7 "2025-12-02T10:26:36Z")
@RajeshKumarY6297 I have reviewed the documentation and log file you sent. Based on what I see I believe the error “No failure response set by custom authentication activity” occurs when the custom authentication activity completes without properly establishing the operator context. The log shows a critical clue: “After activity processing, primary page is no longer valid.” This tells us that even though the JWT validation succeeded, the **activity didn’t set up the operator session correctly**. When using Custom authentication, Pega expects one of two outcomes from the authentication activity. Either the authentication succeeds and you provide a valid operator page via the `pyOperPage` parameter, or it fails and you provide an error message via the `pyFailMessage` parameter. When neither is provided, Pega throws this exception because it’s an invalid state. The current implementation is validating the JWT token (which works fine) but then stops without actually logging the user in. The error message is Pega’s way of complaining that the authentication activity didn’t complete its job properly: it neither logged someone in successfully nor explicitly reported a failure. The solution is to add a step in the custom authentication activity that properly sets the operator context. After the JWT validation succeeds, you need to add a Java step with this code: ```auto tools.getParameterPage().putObject("pyOperPage", myStepPage); ``` `myStepPage` is a reference to an opened operator page. Looking at the JWT payload in the log file, I can see there’s an “api\_user” claim with the value “APIERIMATCH”. This should be used to identify which operator to open. Here’s the recommended flow for the authentication activity: 1. Call pxProcessJWT to validate the JWT token (they’re already doing this successfully) 2. Extract the operator identifier from the JWT claims (the “api\_user” field shows “APIERIMATCH” currently) 3. Use Obj-Open to open that operator 4. Set the parameter: `tools.getParameterPage().putObject("pyOperPage", myStepPage)` where myStepPage is the opened operator 5. Set `pyIsAuthenticated = true` 6. Make sure this step happens BEFORE any error handling logic The key issue is that the current activity is successfully validating the token but then not establishing the operator session, which leaves the authentication in an incomplete state. By adding the pyOperPage parameter setting, you are properly completing the authentication handshake. ---
**Author:** ![VenkatRaman](https://avatars.discourse-cdn.com/v4/letter/v/ac91a4/32.png) [@VenkatRaman](https://forums.pega.com/u/VenkatRaman)\ **Post date:** [December 24, 2025, 9:09pm UTC](https://forums.pega.com/t/rest-service-with-authentication-with-external-identity-provider-azure-ad/10258/8 "2025-12-24T21:09:33Z")
@DionLammers This was needed as well to authenticate the service Packages. pega.getAuthenticationHandle().setUserAuthenticated(pega, true);