title: JwtSecurityTokenHandler().ValidateToken() :: Signature validation failed... sha256 not supported in this context
body: <p>I am getting the following error when I execute the JwtSecurityTokenHandler().ValidateToken() function:</p>
  
  <p>Here is my pseudo-code:</p>
  
  <pre><code>var jwtToken = {...}
  var tokenHandler = new JwtSecurityTokenHandler();
  var validationParameters = new TokenValidationParameters {...};
  var claimsPrincipal = tokenHandler.ValidateToken(jwtToken, validationParameters);
  </code></pre>
  
  <p>And here is the error:</p>
  
  <pre><code>Jwt10316: Signature validation failed. Keys tried: 'System.IdentityModel.Tokens.X509AsymmetricSecurityKey'.
  Exceptions caught:
   'System.InvalidOperationException: Jwt10518: AsymmetricSecurityKey.GetHashAlgorithmForSignature( 'http://www.w3.org/2001/04/xmldsig-more#hmac-sha256' ) threw an exception.
  AsymmetricSecurityKey: 'System.IdentityModel.Tokens.X509AsymmetricSecurityKey'
  SignatureAlgorithm: 'http://www.w3.org/2001/04/xmldsig-more#hmac-sha256', check to make sure the SignatureAlgorithm is supported.
  Exception: 'System.NotSupportedException: Crypto algorithm 'http://www.w3.org/2001/04/xmldsig-more#hmac-sha256' not supported in this context.
     at System.IdentityModel.Tokens.X509AsymmetricSecurityKey.GetHashAlgorithmForSignature(String algorithm)
     at System.IdentityModel.Tokens.AsymmetricSignatureProvider..ctor(AsymmetricSecurityKey key, String algorithm, Boolean willCreateSignatures)'. 
  ---&gt; System.NotSupportedException: Crypto algorithm 'http://www.w3.org/2001/04/xmldsig-more#hmac-sha256' not supported in this context.
     at System.IdentityModel.Tokens.X509AsymmetricSecurityKey.GetHashAlgorithmForSignature(String algorithm)
     at System.IdentityModel.Tokens.AsymmetricSignatureProvider..ctor(AsymmetricSecurityKey key, String algorithm, Boolean willCreateSignatures)
     --- End of inner exception stack trace ---
     at System.IdentityModel.Tokens.AsymmetricSignatureProvider..ctor(AsymmetricSecurityKey key, String algorithm, Boolean willCreateSignatures)
     at System.IdentityModel.Tokens.SignatureProviderFactory.CreateProvider(SecurityKey key, String algorithm, Boolean willCreateSignatures)
     at System.IdentityModel.Tokens.SignatureProviderFactory.CreateForVerifying(SecurityKey key, String algorithm)
     at System.IdentityModel.Tokens.JwtSecurityTokenHandler.ValidateSignature(SecurityKey key, String algorithm, Byte[] encodedBytes, Byte[] signature)
     at System.IdentityModel.Tokens.JwtSecurityTokenHandler.ValidateSignature(JwtSecurityToken jwt, Byte[] signatureBytes, IEnumerable`1 signingTokens)'.
  </code></pre>
  
  <p><strong>System.NotSupportedException: Crypto algorithm '<a href="http://www.w3.org/2001/04/xmldsig-more#hmac-sha256">http://www.w3.org/2001/04/xmldsig-more#hmac-sha256</a>'</strong></p>
  
  <p>The weird part is that right beyond this portion of the error message are the claims that were encoded into the token.  As a work-around, I am doing some text parsing and re-constructing my ClaimsPrincipal, but I shouldn't have to do this.</p>
  
  <p>Any ideas how to enable the sha256 for this context?</p>
  
  <p><strong>UPDATE: Since I have not had any movement on this issue (except for gaining a tumbleweed badge) I will add some more details Maybe someone can help me work through where the problem is coming from.  I have to assume that since nobody else is experiencing this problem is has to be user error on my part somewhere.  Please tell me if anything sounds incorrect.</strong></p>
  
  <p>My guess is that since we are failing jwt validation, then perhaps it has something to do with the cert on the validation machine / idP.</p>
  
  <ol>
  <li>I created an sha256 signing cert for the idP and placed it into the Personal Certificates on the idP.</li>
  <li>I exported the public key of that cert and put into the trusted people's Cert folder of my validation machine.</li>
  <li>I then run the following code on my validation machine after receiving a token from my idP:</li>
  </ol>
  
  <p>Example:</p>
  
  <pre><code>var jwtToken = response.AccessToken;
  var store = new X509Store(StoreName.TrustedPeople, StoreLocation.LocalMachine);
  store.Open(OpenFlags.ReadOnly);
  X509Certificate2 cert = store.Certificates.Find(X509FindType.FindByThumbprint, "thinktecture identityserver 2.Configuration =&gt; Key Configuration =&gt; Signing Thumbprint&gt;", false)[0];
  store.Close();
  var tokenHandler = new JwtSecurityTokenHandler();
  var validationParameters = new TokenValidationParameters
                  {
                      AllowedAudience = "&lt;thinktecture identityserver 2.Configuration =&gt; Relying Party =&gt; Realm/Scope Name&gt;",
                      ValidIssuer = "&lt;thinktecture identityserver 2.Configuration =&gt; General Configuration =&gt; Site ID&gt;",
                      SigningToken = new X509SecurityToken(cert)
                  };
  
  ClaimsPrincipal claimsPrincipal = tokenHandler.ValidateToken(jwtToken, validationParameters);
  </code></pre>
  
  <p>Notice my use of the following placeholders showing where the data is being populated from:</p>
  
  <ul>
  <li><strong>thinktecture identityserver 2.Configuration => Key Configuration => Signing Thumbprint</strong></li>
  <li><strong>thinktecture identityserver 2.Configuration => Relying Party => Realm/Scope Name</strong></li>
  <li><strong>thinktecture identityserver 2.Configuration => General Configuration => Site ID</strong></li>
  </ul>
  
  <p>Is there anything you can see that I am doing wrong in this instance?</p>
  
  <p><strong>UPDATE 2</strong></p>
  
  <p>I ran into this code: <a href="http://pastebin.com/DvQz8vdb">http://pastebin.com/DvQz8vdb</a> and after running my JWT through it I gave me the same error: Basically it's saying it only supports "RS256", "HS384", or "HS512". Perhaps this is my problem.. my JWT is coming back HS256, not RS256 or HS >256 (384/512)</p>
  
  <p><strong>How can I change the signing algorithm from HS256 to say HS512?</strong></p>
  
  <p><strong>And at this point I'm thinking we are back to the Identity Server Issue?</strong></p>