title: Receiving the error message of IDX10501: Signature validation failed. Unable to match keys when using Azure AD
body: <p><strong>Just a heads up:</strong> this question is not a duplicate of <a href="https://stackoverflow.com/questions/51221979/azure-ad-b2c-error-idx10501-signature-validation-failed-unable-to-match-keys">this one</a>, so please do not mark this question as a duplicate.</p>
  
  <p>I scaffolded a web api code that uses Azure Active Directory for authentication by Visual Studio 2019 and followed <a href="https://docs.microsoft.com/bs-latn-ba/azure/active-directory/develop/scenario-protected-web-api-app-configuration" rel="nofollow noreferrer">this document</a> to configure the basic scaffolded application by using the configuration entries of my Azure AD B2C tenant.</p>
  
  <p>The service configuration method looks like the following code snippet:</p>
  
  <pre class="lang-cs prettyprint-override"><code>public void ConfigureServices(IServiceCollection services)
  {
     Microsoft.IdentityModel.Logging.IdentityModelEventSource.ShowPII = true;
              services
                  .AddAuthentication(AzureADDefaults.BearerAuthenticationScheme)
                  .AddAzureADBearer(options =&gt; Configuration.Bind("AzureAd", options));
              services.AddMvc().SetCompatibilityVersion(CompatibilityVersion.Version_2_2);
  }
  </code></pre>
  
  <p>The configuration file contains the following AzureAd configuraiton entry where I masked the actual Ids:</p>
  
  <pre><code>  "AzureAd": {
      "Instance": "https://login.microsoftonline.com/",
      "Domain": "testdirectoryv44.onmicrosoft.com",
      "TenantId": "1234abcdef......,
      "ClientId": "abcdef567....."   
    }
  </code></pre>
  
  <p>By running the userflow on the Azure portal, I obtain a token and am able to decode the token by <a href="https://jwt.ms" rel="nofollow noreferrer">https://jwt.ms</a> which is great. However, I receive the following error message when calling this GET request: <code>https://localhost:44362/api/values</code> by POSTMAN while it is including the bearer token in the header when placing the request: (The error message is shown in the output pane of VS 2019)</p>
  
  <blockquote>
    <p>Microsoft.AspNetCore.Authentication.JwtBearer.JwtBearerHandler:Information:
    Failed to validate the token.</p>
    
    <p>Microsoft.IdentityModel.Tokens.SecurityTokenSignatureKeyNotFoundException:
    IDX10501: Signature validation failed. Unable to match keys:  kid:
    'ABCDEF.........',  token:
    '{"typ":"JWT","alg":"RS256","kid":"ABCDEF........."}.{"exp":1572358190,"nbf":1572354590,"ver":"1.0","iss":"<a href="https://testdirectoryv44.b2clogin.com/abcdef1234556/v2.0/" rel="nofollow noreferrer">https://testdirectoryv44.b2clogin.com/abcdef1234556/v2.0/</a>","sub":"8799abcdef0000","aud":"89000abcdecf999,"nonce":"defaultNonce","iat":1572354590,"auth_time":1572354590,"idp_access_token":"BIGMASKEDVALUE","idp":"<a href="https://sts.windows.net/abcdef11234.../" rel="nofollow noreferrer">https://sts.windows.net/abcdef11234.../</a>","name":"MyName","extension_InternalKey":"KEY400","given_name":"MyName","family_name":"MyFamily","extension_InternalUserId":"guest","tfp":"B2C_1_testdirectoryv44"}'.
    at
    System.IdentityModel.Tokens.Jwt.JwtSecurityTokenHandler.ValidateSignature(String
    token, TokenValidationParameters validationParameters)    at
    System.IdentityModel.Tokens.Jwt.JwtSecurityTokenHandler.ValidateToken(String
    token, TokenValidationParameters validationParameters, SecurityToken&amp;
    validatedToken)    at
    Microsoft.AspNetCore.Authentication.JwtBearer.JwtBearerHandler.HandleAuthenticateAsync()
    Microsoft.AspNetCore.Authentication.JwtBearer.JwtBearerHandler:Information:
    AzureADJwtBearer was not authenticated. Failure message: IDX10501:
    Signature validation failed. Unable to match keys:  kid:
    'REMOVED AREAD'.
    Microsoft.AspNetCore.Routing.EndpointMiddleware:Information: Executing
    endpoint 'WebApplication5.Controllers.ValuesController.Get
    (WebApplication5)'
    Microsoft.AspNetCore.Mvc.Internal.ControllerActionInvoker:Information:
    Route matched with {action = "Get", controller = "Values"}. Executing
    controller action with signature
    Microsoft.AspNetCore.Mvc.ActionResult<code>1[System.Collections.Generic.IEnumerable</code>1[System.String]]
    Get() on controller WebApplication5.Controllers.ValuesController
    (WebApplication5).
    Microsoft.AspNetCore.Authorization.DefaultAuthorizationService:Information:
    Authorization failed.
    Microsoft.AspNetCore.Mvc.Internal.ControllerActionInvoker:Information:
    Authorization failed for the request at filter
    'Microsoft.AspNetCore.Mvc.Authorization.AuthorizeFilter'.
    Microsoft.AspNetCore.Mvc.ChallengeResult:Information: Executing
    ChallengeResult with authentication schemes ().
    Microsoft.AspNetCore.Authentication.JwtBearer.JwtBearerHandler:Information:
    AuthenticationScheme: AzureADJwtBearer was challenged.
    Microsoft.AspNetCore.Mvc.Internal.ControllerActionInvoker:Information:
    Executed action WebApplication5.Controllers.ValuesController.Get
    (WebApplication5) in 22.7988ms
    Microsoft.AspNetCore.Routing.EndpointMiddleware:Information: Executed
    endpoint 'WebApplication5.Controllers.ValuesController.Get
    (WebApplication5)'
    Microsoft.AspNetCore.Hosting.Internal.WebHost:Information: Request
    finished in 792.0596ms 401</p>
  </blockquote>
  
  <p>The Web api's code is as simple as the following code snippet which is scaffolded by Visual Studio 2019:</p>
  
  <pre class="lang-cs prettyprint-override"><code>[Authorize]
      [Route("api/[controller]")]
      [ApiController]
      public class ValuesController : ControllerBase
      {
          // GET api/values
          [HttpGet]
          public ActionResult&lt;IEnumerable&lt;string&gt;&gt; Get()
          {
              return new string[] { "value1", "value2" };
          }
  
          // GET api/values/5
          [HttpGet("{id}")]
          public ActionResult&lt;string&gt; Get(int id)
          {
              return "value";
          }
  
          // POST api/values
          [HttpPost]
          public void Post([FromBody] string value)
          {
              // For more information on protecting this API from Cross Site Request Forgery (CSRF) attacks, see https://go.microsoft.com/fwlink/?LinkID=717803
          }
  
          // PUT api/values/5
          [HttpPut("{id}")]
          public void Put(int id, [FromBody] string value)
          {
              // For more information on protecting this API from Cross Site Request Forgery (CSRF) attacks, see https://go.microsoft.com/fwlink/?LinkID=717803
          }
  
          // DELETE api/values/5
          [HttpDelete("{id}")]
          public void Delete(int id)
          {
              // For more information on protecting this API from Cross Site Request Forgery (CSRF) attacks, see https://go.microsoft.com/fwlink/?LinkID=717803
          }
      }
  </code></pre>
  
  <p>It's been a couple of days that I have been spending time on figuring out the root cause of this failure but no success so far. What point am I missing in the code or in Azure AD configuration causing this issue and why <a href="https://jwt.ms" rel="nofollow noreferrer">https://jwt.ms</a> is able to decode the token successfully?</p>