title: How to resolve Azure Active Directory IDX10500: Signature validation failure
body: <p>We are using Azure B2C Active Directory and attempting to integrate with C# WebApi with OWIN security middleware. I have a native app which allows me to acquire a token successfully from the AD which I then place in a Bearer header and use it in a subsequent webapi call.</p>
  
  <p>I'm running the service locally on my development machine at the moment and have followed online examples for enabling OAuthBearerAuthentication as follows:</p>
  
  <pre><code>var jwtFormat = new JwtFormat(tvps, new OpenIdConnectCachingSecurityTokenProvider(settings.MetadataEndpoint));
  
          app.UseOAuthBearerAuthentication(new OAuthBearerAuthenticationOptions
          {
              // This SecurityTokenProvider fetches the Azure AD B2C metadata &amp; signing keys from the OpenIDConnect metadata endpoint
              AccessTokenFormat = jwtFormat
          });
  </code></pre>
  
  <p>I can see that my call is attempting to be validated (locally running remember) which leaves me with the following error:</p>
  
  <pre><code>An exception of type 'System.IdentityModel.Tokens.SecurityTokenSignatureKeyNotFoundException' occurred in System.IdentityModel.Tokens.Jwt.dll but was not handled in user code
  Additional information: IDX10500: Signature validation failed. Unable to resolve SecurityKeyIdentifier: 'SecurityKeyIdentifier
  </code></pre>
  
  <p>Remembering that I have not got any certificates set up of my own, and the tokens that should be used for validation should presumably be validated by the OpenIdConnectCachingSecurityTokenProvider which gets metadata from the AAD instance. </p>
  
  <p>What do I do to make this work locally? Is this a problem with it running locally at all? </p>
  
  <p>Edit: This is the code taken from Github examples that uses the OpenIdConnectCachingSecurityTokenProvider:</p>
  
  <pre><code>public class OpenIdConnectCachingSecurityTokenProvider : IIssuerSecurityTokenProvider
  {
      private readonly ConfigurationManager&lt;OpenIdConnectConfiguration&gt; _configManager;
      private string _issuer;
      private IEnumerable&lt;SecurityToken&gt; _tokens;
      private readonly string _metadataEndpoint;
  
      private readonly ReaderWriterLockSlim _synclock = new ReaderWriterLockSlim();
  
      public OpenIdConnectCachingSecurityTokenProvider(string metadataEndpoint)
      {
          _metadataEndpoint = metadataEndpoint;
          _configManager = new ConfigurationManager&lt;OpenIdConnectConfiguration&gt;(metadataEndpoint);
  
          RetrieveMetadata();
      }
  
      public string Issuer
      {
          get
          {
              RetrieveMetadata();
              _synclock.EnterReadLock();
              try
              {
                  return _issuer;
              }
              finally
              {
                  _synclock.ExitReadLock();
              }
          }
      }
  
      public IEnumerable&lt;SecurityToken&gt; SecurityTokens
      {
          get
          {
              RetrieveMetadata();
              _synclock.EnterReadLock();
              try
              {
                  return _tokens;
              }
              finally
              {
                  _synclock.ExitReadLock();
              }
          }
      }
  
      private void RetrieveMetadata()
      {
          _synclock.EnterWriteLock();
          try
          {
              var config = _configManager.GetConfigurationAsync().Result;
              _issuer = config.Issuer;
              _tokens = config.SigningTokens;
          }
          finally
          {
              _synclock.ExitWriteLock();
          }
      }
  }
  </code></pre>
  
  <p>It is this class that is responsible for getting the tokens from the metadata endpoint in Azure B2C. Note that we haven't named these, they come provided from the B2C endpoint.</p>