title: Cannot Validate AccessToken with IdentityServer
body: <p>We are using IdentityServer for authentication and we are validating the access token using JwtSecurityTokenHandler ValidateToken. This used to work fine, but after we upgraded our client application to ASP.NET Core 1.0 RTM (from RC1), the validation fails. The received error is: </p>
  
  <pre><code>IDX10501: Signature validation failed. Unable to match 'kid'
  </code></pre>
  
  <p>When I look at the KeyID of the used certificate and the kid of the token, I can see that they are different. I checked the IdentityServer jwks-endpoint to check that I had the correct certificate and noticed that the kid and certificate key id are different from that endpoint too. From what I've understood, they are supposed to be the same?  </p>
  
  <p>Any ideas why the code broke during the upgrade since the certificate, token and IdentityServer are still the same and only the client app core was upgraded.     </p>
  
  <p><strong>EDIT (More information)</strong><br>
  I suspect that ValidateIssuerSigningKey is false by default and the key has not even been validated before (thus it was working). Now it seems that the ValidateIssuerSigningKey is being ignored (as bad practice?) and thus the validation fails.   </p>
  
  <p><strong>Workaround/Fix</strong><br>
  By setting the IssuerSigningKeyResolver manually and giving the key to use in validation explicitly, fixes the issue and validation passes. Not sure how good the workaround is and why the default doesn't work, but at least I can move on for now.  </p>
  
  <p>simplified code...  </p>
  
  <pre><code>new JwtSecurityTokenHandler().ValidateToken(authTokens.AccessToken,
    new TokenValidationParameters()
    {
      IssuerSigningKeys = keys,
      ValidAudience = audience,
      ValidIssuer = issuer,
      IssuerSigningKeyResolver = (arbitrarily, declaring, these, parameters) =&gt; new List&lt;X509SecurityKey&gt; { securityKey }
     }, out securityToken);
  </code></pre>