title: OpenIdConnectAuthenticationOptions and AcquireTokenByAuthorizationCodeAsync: Invalid JWT token
body: <p>I'm trying to authorization code, and then hopefully a refresh token, with the OWIN OIDC middleware. However, I'm getting this error:
  <strong>Microsoft.IdentityModel.Clients.ActiveDirectory.AdalServiceException: 'AADSTS50027: Invalid JWT token. AADSTS50027: Invalid JWT token. Token format not valid.
  Trace ID: 8622dfea-05cd-4080-a52c-ec95a9593800
  Correlation ID: 1cf57566-1e02-4856-a4bc-357d5b16ae8a</strong></p>
  
  <p>Note that the authentication part works: I do get the original IdToken back, and the SecurityTokenValidated Notifications event fires. The error above occurs on the "AcquireTokenByAuthorizationCodeAsync" line.</p>
  
  <p>What I'm trying to do is use IdentityServer as an IdP inbetween Azure AD (upstream) and my client (downstream), and I need to capture the refresh token to validate against AAD when then client tries to use the downstream refresh token, so that I don't issue access tokens when the AAD user has been locked out or removed.</p>
  
  <pre><code>var authority = "https://login.microsoftonline.com/xxx.onmicrosoft.com/v2.0";
  var clientId = "xxx-30f5-47c2-9ddb-b5fcfd583f96";
  var redirectUri = "http://localhost:60546/oidcCallback";
  var clientSecret = "c8RRB4DCUiXMPEotQh2jm2ArgpYAqUMjGhDRKuuJOxxx";
  
  var oidc = new OpenIdConnectAuthenticationOptions
  {
      ClientId = clientId,
      Authority = authority,
      Caption = "OIDC",
      ResponseType = OpenIdConnectResponseTypes.CodeIdToken,
      RedirectUri = redirectUri,
      TokenValidationParameters = new System.IdentityModel.Tokens.TokenValidationParameters() { ValidateIssuer = false },
      SignInAsAuthenticationType = signInAsType,
      Notifications = new OpenIdConnectAuthenticationNotifications
      {
          AuthorizationCodeReceived = async e =&gt;
          {   
              var authContext = new Microsoft.IdentityModel.Clients.ActiveDirectory.AuthenticationContext(authority);
              var result = await authContext.AcquireTokenByAuthorizationCodeAsync(e.ProtocolMessage.Code, new Uri(redirectUri), new ClientAssertion(clientId, clientSecret));
              logger.Info(result.IdToken);
          }
      }
  };
  
  app.UseOpenIdConnectAuthentication(oidc);
  </code></pre>
  
  <p>Thanks!</p>