title: Validate multiple issuers in Azure APIM policy
body: <p>The company I work for has acquired multiple products over the years.<br/>
  We've been developing a shared microservice ecosystem.<br/>
  The products (currently) authenticate to different IDPs (e.g. Auth0, Azure B2C).
  The back-end microservices can handle multiple issuers just fine, but we also want to do authN checks at the API gateway - Azure APIM, and short-circuit if the JWT acces-token is invalid.</p>
  <p>How do I validate multiple issuers in Azure APIM?</p>
  <p>In the <a href="https://docs.microsoft.com/en-us/azure/api-management/api-management-access-restriction-policies#ValidateJWT" rel="nofollow noreferrer">docs</a>, I can see that I can specify multiple issuers, but there's only 1 openid-config. How would it be getting the public signing keys for multiple issuers if there's only 1 openid-config? Presumably it goes to this to get the JWKS endpoint and then the info to verify token signatures...</p>
  <p>Here's part of the APIM (inbound) policy I'm talking about:</p>
  <pre class="lang-xml prettyprint-override"><code>&lt;validate-jwt header-name=&quot;Authorization&quot; failed-validation-httpcode=&quot;401&quot; failed-validation-error-message=&quot;Unauthorized&quot; require-expiration-time=&quot;true&quot; require-signed-tokens=&quot;true&quot;&gt;
      &lt;openid-config url=&quot;https://example-company.au.auth0.com/.well-known/openid-configuration&quot; /&gt;
      &lt;audiences&gt;
          &lt;audience&gt;test&lt;/audience&gt;
          &lt;audience&gt;blah&lt;/audience&gt;
      &lt;/audiences&gt;
      &lt;issuers&gt;
          &lt;issuer&gt;https://example-company.au.auth0.com&lt;/issuer&gt;
          &lt;issuer&gt;http://contoso.com/&lt;/issuer&gt;
      &lt;/issuers&gt;
  &lt;/validate-jwt&gt;
  </code></pre>