title: .AddOpenIdConnect() Middleware Clarification
body: <p>So, I'm trying to implement an OIDC client application using ASP.NET Core 3.1. I am trying to leverage the <code>.AddOpenIdConnect()</code> and <code>.AddJswtBearer()</code> middleware. However, I need some clarification on what this middleware is doing.</p>
  <p>Here is what I currently have for the middleware configuration:</p>
  <pre><code>.AddOpenIdConnect(options =&gt;
  {
      options.Authority = Configuration[&quot;auth:oidc:authority&quot;];
      options.ClientId = Configuration[&quot;auth:oidc:clientid&quot;];
      options.ClientSecret = Configuration[&quot;auth:oidc:clientsecret&quot;];
      options.ResponseType = OpenIdConnectResponseType.Code;
      options.GetClaimsFromUserInfoEndpoint = true;
      options.SaveTokens = true;
  })
  .AddJwtBearer(options =&gt;
  {
      options.Authority = Configuration[&quot;auth:oidc:authority&quot;];
      options.Audience = Configuration[&quot;auth:oidc:clientid&quot;];
      options.TokenValidationParameters = new TokenValidationParameters
      {
          ValidateIssuer = true,
          ValidateAudience = true,
          ValidateLifetime = true,
          ValidIssuer = Configuration[&quot;auth:oidc:authority&quot;],
          ValidAudience = Configuration[&quot;auth:oidc:clientid&quot;],
          ValidateIssuerSigningKey = true,
          ClockSkew = TimeSpan.Zero
       };
  }
  </code></pre>
  <p>I notice that requests to the Authorization server's <code>/.well-known/oidc-configuration</code> and <code>/.well-known/keys</code> endpoints are requested when the application is first started, based on my Fiddler capture below</p>
  <p><a href="https://i.stack.imgur.com/efbx0.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/efbx0.png" alt="Fiddler capture of config and keys endpoint" /></a></p>
  <p>Where does it do that?</p>
  <p>I'm trying to also validate that the JWT received from the authorization server is valid (that it hasn't been tampered with between the time the server sent it, and the time that the client has received it). I understood this to happen when I added the <code>TokenValidationParameters</code> object in the <code>.AddJwtBearer()</code> middleware. To test this, I tried changing <code>Valid Audience</code> in the <code>TokenValidationParameters</code> to something like <code>asdkwewrj</code> which I know is not the valid audience for my token. But, I never got an error from the client saying that the audience was invalid. The authentication still worked, and I was able to access my secure dashboard still.</p>
  <p>Another thing I'm trying to implement is refresh_token grant_type with this OIDC client. I thought that the <code>options.saveTokens</code> in the <code>.AddOpenIdConnect()</code> middleware would allow me to save the tokens. It looks like they're save as cookies, but these cookies look nothing like my token values (my access token is a JWT, but out of the cookies I see, none of them begin with <code>ey</code>).</p>
  <p>In a nutshell, I'm trying to understand the following:</p>
  <ol>
  <li>Does this <code>.AddJwtBearer()</code> middleware validate the ID Token for me if I have the correct <code>JwtBearerOptions</code> defined (like I do above)? Or do I need to manually validate the ID token against the JWKs from the JWKs URI?</li>
  <li>If I have to manually validate the ID token using the JWKs from the JWKs URI, how do I store these JWKs when the middleware makes the request to the <code>/.well-known/keys</code> endpoint?</li>
  <li>How do I get the cookies that correspond to the access token and refresh token, and then send the refresh token to my authorization server?</li>
  <li>I noticed that I can utilize options.Events in both of these middlewares. Would any of those solve any of the items I'm trying to accomplish?</li>
  <li>Overall, what do these two middlewares handle for me, that I shouldn't need to manually do (i.e token validation and/or token renewal)?</li>
  </ol>
  <p>Thank you! I am still fairly new to in-depth ASP.NET development like this, so I appreciate any responses.</p>