title: AADSTS50013: Assertion failed signature validation. [Reason - The key was not found., Thumbprint of key used by client: 'xxxx'
body: <p>I have three applications participating the AzureAD OBO flow :</p>
  <ol>
  <li><p>Angular FrontEnd --&gt; Registered with AzureAD as OIDC app</p>
  </li>
  <li><p>ASP.NET Core Web API --&gt; Registered with AzureAD as SAML app</p>
  </li>
  <li><p>NAV OData Service --&gt; Registered with AzureAD as SAML app</p>
  </li>
  </ol>
  <p>Here goes the complete flow :</p>
  <ol>
  <li><p>Angular frontend application signs a user into Azure AD and request a delegated access token for Web API 1 (ASP.NET Core Web API)</p>
  </li>
  <li><p>Client application then calls Web API 1 with the issued access token</p>
  </li>
  <li><p>Web API 1 in turn needs to call a downstream Web API 2 (NAV OData Services) so it uses its access token (in step 2 above) to request an access token for Web API 2. What happens in this step is that Web API 1 uses the OBO flow to exchange its access token for another resource’s access token. The exchanged token is still issued on behalf of the original sign in user and it has delegated permission.</p>
  </li>
  <li><p>Web API 1 uses the new access token to call Web API 2</p>
  </li>
  </ol>
  <p>In the above I am getting error in the Step 3.</p>
  <p><strong>Error details :</strong></p>
  <pre><code> One or more errors occurred. (AADSTS50013: Assertion failed signature validation. [Reason - The key was not found., Thumbprint of key used by client: 'xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx']
      Trace ID: afc20e5e-ebea-4546-af4b-820f48083e01
      Correlation ID: b5d8d7b5-52d1-430d-af81-d34918970831
      Timestamp: 2021-05-03 11:35:25Z)
  </code></pre>
  <p><a href="https://i.stack.imgur.com/ZH14E.jpg" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/ZH14E.jpg" alt="enter image description here" /></a></p>
  <p>Can anyone help me here by providing their guidance to fix this issue?</p>
  <p>In this case Angular Front is using implicit flow.</p>
  <pre><code>https://login.microsoftonline.com/&lt;TenantId&gt;/oauth2/v2.0/authorize?response_type=token&amp;scope=api://xxxx--&lt;WEB API 1&gt;.default%20openid%20profile&amp;client_id=&lt;Application (client) ID&gt;&amp;redirect_uri=&lt;ApplicationURL&gt;&amp;state=xxxx&amp;nonce=yyyy&amp;client_info=1&amp;x-client-SKU=MSAL.JS&amp;x-client-Ver=msal&amp;login_hint=mytestaccount@mydomain.com&amp;client-request-id=yyyyyy&amp;prompt=none&amp;response_mode=fragment
  </code></pre>
  <p>Here goes the id_token received :</p>
  <pre><code>{
    &quot;aud&quot;: &quot;&lt;Application (client) ID&gt;&quot;,
    &quot;iss&quot;: &quot;https://login.microsoftonline.com/&lt;tenantid&gt;/v2.0&quot;,
    &quot;iat&quot;: 1620380572,
    &quot;nbf&quot;: 1620380572,
    &quot;exp&quot;: 1620384472,
    &quot;aio&quot;: &quot;AWQAm/8TAAAAIVowa1CNNUEB/tB/OcgatUBo9SzDJch09USynyiE+S+be6xkV9TczjRol4Td0czWrdsrzoqDBHUQxbAcnPT90InTNwLfYeHon5Vvk6eFsn2omrgpYlCj90QIXtIoduhd&quot;,
    &quot;email&quot;: &quot;mytestaccount@mydomain.com&quot;,
    &quot;name&quot;: &quot;mytestaccount, mytestaccount&quot;,
    &quot;nonce&quot;: &quot;078bca2a-35ef-457d-96d8-92db7ac3d106&quot;,
    &quot;oid&quot;: &quot;96035811-49f6-4246-923f-4edba4555e14&quot;,
    &quot;preferred_username&quot;: &quot;mytestaccount@mydomain.com&quot;,
    &quot;rh&quot;: &quot;0.ASYA8UXaNizdH02vE1q-RrmZIYsBYTzBse5Co7kY9CZdWDcmALA.&quot;,
    &quot;sub&quot;: &quot;BAc2RwnOjKjv8vxtS0zOSQ0kgQ74zEvWJDmWnMoWdyM&quot;,
    &quot;tid&quot;: &quot;36da45f1-dd2c-4d1f-af13-5abe46b99921&quot;,
    &quot;uti&quot;: &quot;8r7u-zYcr0GSNUdl4STUAQ&quot;,
    &quot;ver&quot;: &quot;2.0&quot;
  }
  </code></pre>
  <p>Access token for accessing WEB API 1:</p>
  <pre><code>{
    &quot;aud&quot;: &quot;api://xxxx--&lt;WEB API 1&gt;&quot;,
    &quot;iss&quot;: &quot;https://sts.windows.net/36da45f1-dd2c-4d1f-af13-5abe46b99921/&quot;,
    &quot;iat&quot;: 1620380574,
    &quot;nbf&quot;: 1620380574,
    &quot;exp&quot;: 1620384474,
    &quot;acr&quot;: &quot;1&quot;,
    &quot;aio&quot;: &quot;AVQAq/8TAAAAoi/awR8N8P1eapXNZfcGKhsy9uKyL6qv77raeIKYLOyZjXtsVKXMELCu+qZvKJtSaYm/nemvyUPc2OvJiPrvwpwrteqSU1iYM5C4xfPTxHo=&quot;,
    &quot;amr&quot;: [
      &quot;pwd&quot;,
      &quot;rsa&quot;,
      &quot;mfa&quot;
    ],
    &quot;appid&quot;: &quot;&lt;Application (client) ID&gt;&quot;,
    &quot;appidacr&quot;: &quot;0&quot;,
    &quot;deviceid&quot;: &quot;b55e39a3-f492-4679-83e2-53fcd024beba&quot;,
    &quot;email&quot;: &quot;mytestaccount@mydomain.com&quot;,
    &quot;family_name&quot;: &quot;mytestaccount&quot;,
    &quot;given_name&quot;: &quot;mytestaccount&quot;,
    &quot;ipaddr&quot;: &quot;xx.xx.xx.xx&quot;,
    &quot;name&quot;: &quot;mytestaccount, mytestaccount&quot;,
    &quot;oid&quot;: &quot;96035811-49f6-4246-923f-4edba4555e14&quot;,
    &quot;onprem_sid&quot;: &quot;S-1-5-21-238447276-1040861923-1850952788-976396&quot;,
    &quot;rh&quot;: &quot;0.ASYA8UXaNizdH02vE1q-RrmZIYsBYTzBse5Co7kY9CZdWDcmALA.&quot;,
    &quot;scp&quot;: &quot;user_impersonation&quot;,
    &quot;sub&quot;: &quot;F5atxEe7z2ooojdNoFhaAG_Xs2SBnnkYKJ4yCCWT1HA&quot;,
    &quot;tid&quot;: &quot;36da45f1-dd2c-4d1f-af13-5abe46b99921&quot;,
    &quot;unique_name&quot;: &quot;mytestaccount@mydomain.com&quot;,
    &quot;upn&quot;: &quot;mytestaccount@mydomain.com&quot;,
    &quot;uti&quot;: &quot;ll2WpznLGEq23DrUk4eoAQ&quot;,
    &quot;ver&quot;: &quot;1.0&quot;
  }
  </code></pre>