title: How to configure Microsoft JWT with symmetric key?
body: <p>I'm trying to configure my ASP.NET app to accept a JSON Web Token (JWT) that is signed with a symmetric key. The STS isn't capable of using certificates for this, so we're using their symmetric key support.</p>
  
  <p>On my end, I'm using <a href="http://blogs.msdn.com/b/vbertocci/archive/2012/11/20/introducing-the-developer-preview-of-the-json-web-token-handler-for-the-microsoft-net-framework-4-5.aspx">Microsoft's JWT Developer Preview</a>. Unfortunately, I've not seen any examples of how to use that with a symmetric key. After some digging around with various tools, I found the <code>NamedKeyIssuerTokenResolver</code> and discovered that I <em>can</em> configure it to use a symmetric key. For example:</p>
  
  <pre><code>&lt;securityTokenHandlers&gt;
    &lt;add type="Microsoft.IdentityModel.Tokens.JWT.JWTSecurityTokenHandler,Microsoft.IdentityModel.Tokens.JWT" /&gt;
    &lt;securityTokenHandlerConfiguration&gt;
      &lt;certificateValidation certificateValidationMode="PeerTrust" /&gt;
      &lt;issuerTokenResolver
        type="Microsoft.IdentityModel.Tokens.JWT.NamedKeyIssuerTokenResolver,
          Microsoft.IdentityModel.Tokens.JWT"&gt;
        &lt;securityKey
            symmetricKey="+zqf97FD/xyzzyplugh42ploverFeeFieFoeFooxqjE="
               name="https://localhost/TestRelyingParty" /&gt;
      &lt;/issuerTokenResolver&gt;
    &lt;/securityTokenHandlerConfiguration&gt;
  &lt;/securityTokenHandlers&gt;
  </code></pre>
  
  <p>I'm not entirely sure what I'm supposed to use for the <code>name</code> there. Should it be the audience Uri, perhaps the issuer Uri? In any case, I know that if I don't include a <code>name</code>, I get an exception when my program starts because the <code>securityKey</code> element requires that attribute.</p>
  
  <p>Whatever the case, this still doesn't resolve the issue. After I authenticate against the STS, I get the following exception:</p>
  
  <pre><code>[SecurityTokenValidationException: JWT10310: Unable to validate signature. validationParameters.SigningTokenResolver type: 'Microsoft.IdentityModel.Tokens.JWT.NamedKeyIssuerTokenResolver', was unable to resolve key to a token.
  The SecurityKeyIdentifier is: 
  'SecurityKeyIdentifier
      (
      IsReadOnly = False,
      Count = 1,
      Clause[0] = Microsoft.IdentityModel.Tokens.JWT.NamedKeyIdentifierClause
      )
  '. validationParameters.SigningToken was null.]
     Microsoft.IdentityModel.Tokens.JWT.JWTSecurityTokenHandler.ValidateSignature(JWTSecurityToken jwt, TokenValidationParameters validationParameters) +2111
     Microsoft.IdentityModel.Tokens.JWT.JWTSecurityTokenHandler.ValidateToken(JWTSecurityToken jwt, TokenValidationParameters validationParameters) +138
     Microsoft.IdentityModel.Tokens.JWT.JWTSecurityTokenHandler.ValidateToken(SecurityToken token) +599
     System.IdentityModel.Tokens.SecurityTokenHandlerCollection.ValidateToken(SecurityToken token) +135
     System.IdentityModel.Services.TokenReceiver.AuthenticateToken(SecurityToken token, Boolean ensureBearerToken, String endpointUri) +117
     System.IdentityModel.Services.WSFederationAuthenticationModule.SignInWithResponseMessage(HttpRequestBase request) +698
     System.IdentityModel.Services.WSFederationAuthenticationModule.OnAuthenticateRequest(Object sender, EventArgs args) +123924
     System.Web.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() +80
     System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean&amp; completedSynchronously) +165
  </code></pre>
  
  <p>Am I missing some other configuration step? Am I putting the wrong thing in the <code>name</code> attribute? Or is this a known bug in the JWT Developer Preview?</p>