title: SecurityTokenSignatureKeyNotFoundException when validating JWT signature
body: <p>I'm trying to implement the OpenID Connect specification for my organisation. I'm using Microsoft's OWIN implementation of OpenID Connect in a test relying party application to verify my implementation of the protocol.</p>
  
  <p>I've exposed the following metadata document:</p>
  
  <pre><code>{
    "issuer": "https://acs.contoso.com/",
    "authorization_endpoint": "http://localhost:53615/oauth2/auth",
    "token_endpoint": "http://localhost:53615/oauth2/token",
    "userinfo_endpoint": "http://localhost:53615/connect/userinfo",
    "jwks_uri": "http://localhost:53615/connect/keys",
    "ui_locales_supported": [
      "en-GB"
    ]
  }
  </code></pre>
  
  <p>The signing key is exposed as this document:</p>
  
  <pre><code>{
    "keys": [
      {
        "n": "xpXxl3M-YkZlzQJdArO1TfOGT2no-UL4dbZ7WuSCNIsSfyGDaqUXjMMHNyq9yD3vp-NCyk8kmn7d5XqHufnceXJM8q4xTrhN3lvywdBSbR-dwXsA-B-MJVgfiK0d_z-mxP9ew2Hj9-KkWbWCzsswlWp3gZ4mB4RGutB1IRSzXVIbvZ-MtKUb6XUDU4LDb_c1xCEXWZxhR-o1a1dLfObH2hHJ-w5y6odGlKtOFx4i4h0u7-Oj5R6k5b2YXEHM0IuYeN0u0sQvrTecokntGzPrvhnKy69I7Z_az5rC5kgloh25D9lTbe4vcRU7FXlYCFYDZsT0_IkGIXRi7brOS4f1ow",
        "e": "AQAB",
        "kty": "RSA",
        "use": "sig",
        "alg": "RS256",
        "kid": "F8A59280B3D13777CC7541B3218480984F421450"
      }
    ]
  }
  </code></pre>
  
  <p>The identity token is being generated using the <a href="http://msdn.microsoft.com/en-us/library/system.identitymodel.tokens.jwtsecuritytoken(v=vs.114).aspx" rel="noreferrer"><code>JwtSecurityToken</code></a> class and its associated handler, using the <code>X509SigningCredentials</code> class. This code is representative of how the token is constructed and returned to the calling system as a parameter of the response data.</p>
  
  <pre><code>var credentials = new X509SigningCredentials(cert); // My certificate.
  var issuedTime = DateTime.UtcNow;
  var expiresTime = issuedTime.AddMinutes(5);
  var epoch = new DateTime(1970, 01, 01, 0, 0, 0);
  
  var claims = new[]
  {
      new Claim("sub", Guid.NewGuid().ToString()),
      new Claim("iat" Math.Floor((issuedTime - epoch).TotalSeconds).ToString()),
      new Claim("nonce", nonce), // Value from client
  }
  
  var token = new JwtSecurityToken(
      "https://acs.contoso.com",
      client_id, // Value from client
      claims,
      new Lifetime(issuedTime, expiresTime),
      credentials);
  
  var handler = new JwtSecurityTokenHandler();
  parameters.Add("id_token", handler.WriteToken(token)); // Outgoing parameters.
  </code></pre>
  
  <p>When I attempt to pass the signed token back to the relying party application, the OWIN middleware accepts the POST and attempts to verify the signature of the token. In doing so, the following exception is thrown:</p>
  
  <blockquote>
    <p>SecurityTokenSignatureKeyNotFoundException: IDX10500: Signature
    validation failed. Unable to resolve SecurityKeyIdentifier:
    'SecurityKeyIdentifier ( IsReadOnly = False, Count = 1, Clause[0] =
    X509ThumbprintKeyIdentifierClause(Hash =
    0xF8A59280B3D13777CC7541B3218480984F421450) ) ', token:
    '{"typ":"JWT","alg":"RS256","x5t":"-KWSgLPRN3fMdUGzIYSAmE9CFFA"}.{"iss":"<a href="https://test.accesscontrol.net/" rel="noreferrer">https://test.accesscontrol.net/</a>","aud":"test","nbf":1404917162,"exp":1404917462,"sub":"60eb55ec-0699-4068-bfa6-41666fc2b2e9","iat":"1404917162"}
    RawData:
    eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6Ii1LV1NnTFBSTjNmTWRVR3pJWVNBbUU5Q0ZGQSJ9.eyJpc3MiOiJodHRwczovL2Fjcy5zdXJlY2xvdWQuY29tLyIsImF1ZCI6InRlc3QiLCJuYmYiOjE0MDQ5MTcxNjIsImV4cCI6MTQwNDkxNzQ2Miwic3ViIjoiNjBlYjU1ZWMtMDY5OS00MDY4LWJmYTYtNDE2NjZmYzJiMmU5IiwiaWF0IjoiMTQwNDkxNzE2MiJ9.xkP0RwlX3CYfU0KhFsVvLJC94WK22DTqNTm71cfjiJ8VUHv3b2YhDqfq70N8mQEyiR8vTR6OQqnO6UqXqX4RXUs6ZkfK9Liv3n9NhCs97wJhP2jfefJYeScYtRmWcNNWSSL7vkm2JXQfwKOQTnOGp-ba04TtI6jVrjhOQXH43eCJ9vNuBUzdD-t8CAdmnbvH0nWpIB8kWbw5v8Sa0aQuxMjJYbLC_2Iw3X13dqnyVjp4fA7eSB8N7c1it0KEB-VKfUqiGD3VecyEZGGZbaGE8rvVet5QrY1lJ3V4yM8j6-xDc5Yndc4swOun0L3D6TYk-8gdVXUJDRjbv1ZuhZltsw'.</p>
  </blockquote>
  
  <p>The component is still pre-release, so this may be a flaw in the implementation, however I want to assume it's my error until all possibilities have been ruled out.</p>
  
  <p>Is there anything I'm doing which is obviously wrong, or is there something I should do to understand exactly why the signature is failing to be validated?</p>