{"action":"closed","issue":{"url":"https://api.github.com/repos/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/issues/736","repository_url":"https://api.github.com/repos/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet","labels_url":"https://api.github.com/repos/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/issues/736/labels{/name}","comments_url":"https://api.github.com/repos/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/issues/736/comments","events_url":"https://api.github.com/repos/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/issues/736/events","html_url":"https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/issues/736","id":258546080,"number":736,"title":"Q: Token validation with Azure KeyVault (within identity server 4)","user":{"login":"wyle-e-coyote","id":2027400,"avatar_url":"https://avatars2.githubusercontent.com/u/2027400?v=4","gravatar_id":"","url":"https://api.github.com/users/wyle-e-coyote","html_url":"https://github.com/wyle-e-coyote","followers_url":"https://api.github.com/users/wyle-e-coyote/followers","following_url":"https://api.github.com/users/wyle-e-coyote/following{/other_user}","gists_url":"https://api.github.com/users/wyle-e-coyote/gists{/gist_id}","starred_url":"https://api.github.com/users/wyle-e-coyote/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wyle-e-coyote/subscriptions","organizations_url":"https://api.github.com/users/wyle-e-coyote/orgs","repos_url":"https://api.github.com/users/wyle-e-coyote/repos","events_url":"https://api.github.com/users/wyle-e-coyote/events{/privacy}","received_events_url":"https://api.github.com/users/wyle-e-coyote/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2017-09-18T16:42:08Z","updated_at":"2017-09-18T20:02:41Z","closed_at":"2017-09-18T20:02:41Z","author_association":"NONE","body":"This is within an Identity Server 4 environment.  Please see this ticket for details [IdentityServer4 1537](https://github.com/IdentityServer/IdentityServer4/issues/1537).\r\n\r\nI'm currently successfully signing tokens using Azure KeyVault.  However, when I retrieve the public keys for validating the signature, I am getting the following exception (again more details in link above):\r\n\r\n```\r\nMicrosoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectMiddleware: Error: Unable to read the 'id_token', no suitable ISecurityTokenValidator was found for: 'eyJhbGciOiJSUzI1NiIsImtpZCI6IjMzMzcxYWMwNmRjMzQxYzBhMzM1NzBhZmEzNjBhOGQ1IiwidHlwIjoiSldUIn0.eyJuYmYiOjE1MDU3NDEzNzcsImV4cCI6MTUwNTc0MTY3NywiaXNzIjoiaHR0cDovL2xvY2FsLmFuZGkuY29tL2lkZW50aXR5IiwiYXVkIjoiYW5kaS5nYWxsZXJ5LmNsaWVudCIsIm5vbmNlIjoiNjM2NDEzMzgxNzcwNTEwNTU1Lk0yWmpObU00TnpNdE56a3pPQzAwTnpOa0xUbGxNalF0TXpReVpHVTJNV0ppWW1JeU5qYzNZbVkwWVRZdFl6VTRaUzAwTkRFd0xXSTFNREF0WW1JeVltWTRPRFZtT0dFMiIsImlhdCI6MTUwNTc0MTM3Nywic2lkIjoiMzNiM2ZmNzE2ZjZkZDg1NTdjMWI4YTUzYmQ2ZjBjZmEiLCJzdWIiOiIyYTI1ZDFlYi1hZTdkLTQxMjctYWY0OC1kNzYzNmNkOTkzZjUiLCJhdXRoX3RpbWUiOjE1MDU3NDEzNzMsImlkcCI6ImxvY2FsIiwibmFtZSI6ImNsYXdyZW5jZUBwcmVjaXNpb25sZW5kZXIuY29tIiwiZW1haWwiOiJjbGF3cmVuY2VAcHJlY2lzaW9ubGVuZGVyLmNvbSIsImFuZGkub3JnSWQiOiI5OWI5NDEyYi03MGZkLTQyMjEtODQzMS1kMWIzOTM0ODg5ZWMiLCJhbXIiOlsicHdkIl19.GDlw0vEShMHmjG19QeQE0MYESlePrzBnfUxHtQZ2vfbbPi8WuUjr2VGFrxDlzkqCwGOq8j7FZQ83OlfrMk8aZYd5J8ZsVKwruoHPdmGRpnjj2wv/5Ujk7545rdCxwT61NesIa43hFf9qxI7IRr5N6+TQFVjLaGZpmcpT/c5lKhgqPstMpcoZeObQYPv+VSoDnGRXRd2aHn4fhZQz9OMw1ZWfGNa77yw+UD9YL6nWOEWhpdDodbn7+QfUK6k148BmLYzXo/2BPvW/NmSNsjUBEPHdHkAt8aQBxY6EKKtV7/Q6r/dW66yDNWxLrU2DR4SmPnOzsasPOFQ1PYXzbaf7Hg=='.\r\nMicrosoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectMiddleware: Error: Exception occurred while processing message.\r\n```\r\nPublic portion of the key:\r\n```\r\n{\r\n    \"keys\": [\r\n        {\r\n            \"kty\": \"RSA\",\r\n            \"use\": \"sig\",\r\n            \"kid\": \"33371ac06dc341c0a33570afa360a8d5\",\r\n            \"e\": \"AQAB\",\r\n            \"n\": \"0mJrfNkwptknurikY_czpq2Q3oVb4Y9vYj7zXt7H0gsfyyHHSeY0-DmJBKhSlt99LZ2YMKo1xFery4s0iS-yAWhfJ5JUCjVZnIfMk9lAOupyCbknwOU4AibGOC_4VURgjHOfSVZ_cVNrC9h6fgcgTMkxTm-XtLvdfmXfFxHk-OOtN_saN7wrQU7jRgDT4Aare_uJmuOcbxh73Ts9d6K15FWu7amflc5QgWnOGfAnJr151ITA0GIqWVlWsz8LHWL2INI0NnT3sYOGIQ0OwxCdgZIpzRmXZRw0jerOPevJyxx_1t6N4lSx95aNt2xuXM-W7zu40MDh3CstK4fqzcus-w\"\r\n        }\r\n    ]\r\n}\r\n```\r\nIf the token is plugged into jwt.io, you can see the 'kid' within the header is the same:\r\n```\r\n{\r\n  \"alg\": \"RS256\",\r\n  \"kid\": \"33371ac06dc341c0a33570afa360a8d5\",\r\n  \"typ\": \"JWT\"\r\n}\r\n```\r\n\r\nAny help with this would be appreciated.\r\n"}}
{"actor":{"display_login":"wyle-e-coyote"}}