title: ASP.Net Azure OpenId integration
body: <p>I am trying to create a project that uses Azure AD for SSO authentication. The azure side of the app has been configured and I was able to get SAML authentication working with the following code: </p>
  
  <pre><code>app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);
  
  app.UseCookieAuthentication(new CookieAuthenticationOptions());
  
  app.UseWsFederationAuthentication(
      new WsFederationAuthenticationOptions
      {
          Wtrealm = realm,
          MetadataAddress = adfsMetadata
      });
  </code></pre>
  
  <p>Configured this way the site works fine for web pages, but I also need to be able to have API calls that are called from a native client. I would like to use JWTs for authentication for the native apps and found documentation on how to set up a separate native application that serves up JWTs. I found instructions on using the <strong>Add Connected Service</strong> to add authentication to a blank site <a href="https://stackoverflow.com/questions/27581744/how-to-add-azure-ad-authentication-to-existing-asp-net-mvc-application">here</a> and it seemed to configure the site to use OpenId with the following code in my Startup.Auth.cs file being created:</p>
  
  <pre><code>IdentityModelEventSource.ShowPII = true;
  
  app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);
  
  app.UseCookieAuthentication(new CookieAuthenticationOptions());
  
  app.UseOpenIdConnectAuthentication(
      new OpenIdConnectAuthenticationOptions
      {
          ClientId = clientId,
          Authority = Authority,
          PostLogoutRedirectUri = postLogoutRedirectUri
      });
  </code></pre>
  
  <p>Unfortunately when I run the newly configured blank site I get the following error:</p>
  
  <blockquote>
    <p>IDX10501: Signature validation failed. Unable to match keys:
    'Vxa8HJ8gNB1XfxYnIDHBl2YuSFc',  token:
    '{"typ":"JWT","alg":"RS256","x5t":"Vxa8HJ8gNB1XfxYnIDHBl2YuSFc","kid":"Vxa8HJ8gNB1XfxYnIDHBl2YuSFc"}.{"aud":"c13f71a0-e658-4432-a61e-24140f2b5890","iss":"<a href="https://sts.windows.net/8948afa6-51e3-4041-8303-5688ba9c8135/" rel="nofollow noreferrer">https://sts.windows.net/8948afa6-51e3-4041-8303-5688ba9c8135/</a>","iat":1542235664,"nbf":1542235664,"exp":1542239564,"aio":"ASQA2/8JAAAA6+NtWgTWs4mQi7gcoqDJMWDjmQtgxL79oC3U112+XjI=",...</p>
  </blockquote>
  
  <p>I've looked at the OpenId metadata for my app and key <strong>Vxa8HJ8gNB1XfxYnIDHBl2YuSFc</strong> isn't in there anywhere. Is there something simple that I have missed?</p>
  
  <p><strong>Edit</strong></p>
  
  <hr>
  
  <p>It looks like the authority that was configured was </p>
  
  <pre><code>https://login.microsoftonline.com/{tenant}
  </code></pre>