title: Cannot validate token in UseJwtBearerAuthentication. Authorization has been denied
body: <p>Using a single asp.net(4.6.1) web project, apparently I'm unable to validate the jwt token that was generated on the same server.<br />
  <strong>Startup.cs</strong>:</p>
  <pre><code>        var secret = Encoding.UTF8.GetBytes(&quot;12341234123412341234&quot;);
          var jwtFormatter = new CustomJwtFormat(&quot;Any&quot;, &quot;local&quot;, secret);
  
          // This part checks the tokens
          app.UseJwtBearerAuthentication(new JwtBearerAuthenticationOptions
          {
              AuthenticationType = DefaultAuthenticationTypes.ExternalBearer,
              AuthenticationMode = AuthenticationMode.Active, // Block requests
              AllowedAudiences = new []{&quot;Any&quot;},
              TokenValidationParameters = new TokenValidationParameters
              {
                  IssuerSigningKey = new InMemorySymmetricSecurityKey(secret),
                  ValidAudience = &quot;Any&quot;,
                  ValidIssuer = &quot;local&quot;
              }
          });
          
          // This part issues tokens
          app.UseOAuthAuthorizationServer(new OAuthAuthorizationServerOptions
          {
              AllowInsecureHttp = false,
              TokenEndpointPath = new PathString(&quot;/auth&quot;),
              AccessTokenExpireTimeSpan = TimeSpan.FromMinutes(30),
              Provider = new CustomOAuthProvider(),
              AccessTokenFormat = jwtFormatter,
              RefreshTokenFormat = jwtFormatter
              
          });
  
          app.UseWebApi(config);
  </code></pre>
  <p>The class that generates the tokens looks like</p>
  <pre><code>public class CustomJwtFormat : ISecureDataFormat&lt;AuthenticationTicket&gt;
  {
      private readonly string _allowedAudience;
      private readonly string _issuer;
      private readonly byte[] _jwtTokenSignKey;
  
      public CustomJwtFormat(string allowedAudience, string issuer, byte[] jwtTokenSignKey)
      {
          _allowedAudience = allowedAudience;
          _issuer = issuer;
          _jwtTokenSignKey = jwtTokenSignKey;
      }
  
      public string Protect(AuthenticationTicket data)
      {
          if (data == null) throw new ArgumentNullException(nameof(data));
          
          var signingCredentials = new SigningCredentials
          (
              new InMemorySymmetricSecurityKey(_jwtTokenSignKey),
              &quot;http://www.w3.org/2001/04/xmldsig-more#hmac-sha256&quot;,
              &quot;http://www.w3.org/2001/04/xmlenc#sha256&quot;
          );
  
          return new JwtSecurityTokenHandler().WriteToken(new JwtSecurityToken(
              _issuer, 
              _allowedAudience, 
              data.Identity.Claims, 
              DateTime.UtcNow, DateTime.UtcNow.AddMinutes(10), 
              signingCredentials
          ));
          
      }
  
      public AuthenticationTicket Unprotect(string protectedText)
      {
          throw new NotImplementedException();
      }
  }
  </code></pre>
  <p>The tokens I receive from <code>/auth</code> look valid and pass the debugger on <code>jwt.io</code> (without marking base64 for signature)
  <a href="https://i.stack.imgur.com/i0KAg.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/i0KAg.png" alt="image" /></a></p>
  
  <p>However <code>UseJwtBearerAuthentication</code> refuses to validate the token.
  <a href="https://i.stack.imgur.com/tQptd.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/tQptd.png" alt="image" /></a></p>
  
  <p>What could be the possible reason for this ?</p>
  <p>Moreover, I've tried manually validating the same token in a controller without <code>[Authorize]</code> and it would perfectly validate:</p>
  <pre><code>        var t = &quot;eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpZCI6IjEiLCJpc3MiOiJsb2NhbCIsImF1ZCI6IkFueSIsImV4cCI6MTQ3MjkxMDcwMSwibmJmIjoxNDcyOTEwMTAxfQ.ipSrRSGmje7wfzERsd-M1IDFJnN99AIC4Hs7YX4FIeI&quot;;
          var TokenHandler = new JwtSecurityTokenHandler();;
          var key = Encoding.UTF8.GetBytes(&quot;12341234123412341234&quot;);
          SecurityToken validatedToken;
          TokenValidationParameters paras = new TokenValidationParameters()
          {
              IssuerSigningKey = new InMemorySymmetricSecurityKey(key),
              ValidAudience = &quot;Any&quot;,
              ValidIssuer = &quot;local&quot;
          };
          TokenHandler.ValidateToken(t, paras, out validatedToken);
  </code></pre>
  <p>Owin 3.0.1.0
  System.IdentityModel.Tokens.Jwt 4.0.3.308261200</p>