title: Azure API Management JWT validation fails
body: <p>I'm trying to implement JWT validation as demonstrated in <a href="https://azure.microsoft.com/pl-pl/resources/videos/episode-177-more-api-management-features-with-vlad-vinogradsky/" rel="nofollow noreferrer">this video</a>.</p>
  
  <p>To achieve this I've implemented the following policies:</p>
  
  <pre><code>&lt;policies&gt;
  &lt;inbound&gt;
      &lt;validate-jwt header-name="Authorization" failed-validation-httpcode="401" failed-validation-error-message="No auth" require-expiration-time="false" require-signed-tokens="false"&gt;
          &lt;issuer-signing-keys&gt;
              &lt;key&gt; base64key &lt;/key&gt;
          &lt;/issuer-signing-keys&gt;
      &lt;/validate-jwt&gt;
      &lt;return-response&gt;
          &lt;set-status code="200" reason="OK" /&gt;
          &lt;set-body&gt;test&lt;/set-body&gt;
      &lt;/return-response&gt;
      &lt;base /&gt;
  &lt;/inbound&gt;
  &lt;backend&gt;
      &lt;base /&gt;
  &lt;/backend&gt;
  &lt;outbound&gt;
      &lt;base /&gt;
  &lt;/outbound&gt;
  &lt;on-error&gt;
      &lt;base /&gt;
  &lt;/on-error&gt;
  </code></pre>
  
  <p></p>
  
  <p><em>require-signed-tokens</em> and <em>require-expiration-time</em> will be enabled in production - I was trying to disable as much validation as i could just to get this running.</p>
  
  <p>Then on JWT.io I'm generating a token:
  <a href="https://i.stack.imgur.com/IwsFh.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/IwsFh.png" alt="enter image description here"></a></p>
  
  <p>Then it's time to get some data from the API:</p>
  
  <pre><code>import urllib.request
  
  headers = {"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOiIxNTM0MDAzOTk4In0.0DlazlR4-InCb-m0dBs-9BbPbyvu5s7Opr8uXIUaMdA"}
  api_request = urllib.request.Request("https://someapi", headers=headers)
  try:
      api_response = urllib.request.urlopen(api_request)
      print(api_response.read())
  except urllib.error.HTTPError as e:
      print(e.read())
  </code></pre>
  
  <p>Note that there is no <em>Ocp-Apim-Subscription-Key</em> header as the product containing the API doesn't require a subscription, thou I've also tested it with one.
  And the result:</p>
  
  <pre><code>b'{ "statusCode": 401, "message": "No auth" }'
  </code></pre>
  
  <p>API request trace doesn't provide any useful information.</p>
  
  <p>Is there anything obvious that I'm missing?</p>