title: ASP.NET Core: How to validate a JWT without access to the internet
body: <p>So this is how I validate a JWT bearer token in backend:</p>
  
  <pre><code>services.AddAuthentication(options =&gt;
              {
                  options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
                  options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
              }).AddJwtBearer(options =&gt;
              {
                  options.Authority = $"https://{Configuration["Auth0:Authority"]}";
                  options.Audience = Configuration["Auth0:Audience"];
              });
  </code></pre>
  
  <p>It works fine as .Net core consults with the authority to get required info (such as signing key) under the hood. In my case it talks to Auth0 servers via https://&lt; MY TENANT > .auth0.com/.well-known/openid-configuration.</p>
  
  <p>The problem is my application cannot talk to the Auth0 server when I deploy it in an Intranet which doesn't have access to the internet. Here's the error I get:</p>
  
  <pre><code>System.InvalidOperationException: IDX20803: Unable to obtain configuration from: 'https://&lt; My TENANT &gt;.auth0.com/.well-known/openid-configuration'.
  </code></pre>
  
  <p>I tried feeding RSA key manually, but not luck and same error:</p>
  
  <pre><code>AddJwtBearer(options =&gt;
              {
                  options.Authority = $"https://{Configuration["Auth0:Domain"]}";
                  options.Audience = Configuration["Auth0:Audience"];
                  options.TokenValidationParameters = new TokenValidationParameters
                  {
                      ValidateLifetime = true,
                      RequireSignedTokens = true,
                      ValidateIssuerSigningKey = true,
                      IssuerSigningKey = GetRsaKey(),
                  };
              }); 
  
   private SecurityKey GetRsaKey()
          {
              byte[] modulus = Decode("r5cpJ....-fUGjJCH1QQ");
              byte[] exponent = Decode("A...AB");
  
              var rsaParameters = new RSAParameters
              {
                  Modulus = modulus,
                  Exponent = exponent
              };
  
              using var rsaProvider = new RSACryptoServiceProvider();
              rsaProvider.ImportParameters(rsaParameters);
              return new RsaSecurityKey(rsaProvider);
          }
  
  </code></pre>
  
  <p>Any workaround?</p>