title: Validating OpenId IdToken On Each Request
body: <p>I'm trying to validate the IdToken I get from Azure AD on each request but I keep getting an error saying that there is no signature on the token. When I validate the Access Token it works, but I would rather use the Id Token as that contains the users claims. Is there anyway to make Azure send back the Id Token with the signature as well?</p>
  
  <pre><code>public JwtSecurityToken ValidateJwtToken(string jwtToken)
      {
          string stsDiscoveryEndpoint = $"{_authority}/.well-known/openid-configuration";
  
         ConfigurationManager&lt;OpenIdConnectConfiguration&gt; configManager =
              new ConfigurationManager&lt;OpenIdConnectConfiguration&gt;(stsDiscoveryEndpoint, new OpenIdConnectConfigurationRetriever());
  
         OpenIdConnectConfiguration config = configManager.GetConfigurationAsync().Result;
  
         TokenValidationParameters validationParameters = new TokenValidationParameters
          {
              ValidateAudience = false,
              ValidateIssuer = false,
              ValidateLifetime = false,
              IssuerSigningKeys = config.SigningKeys
          };
  
         JwtSecurityTokenHandler tokendHandler = new JwtSecurityTokenHandler();
  
         try
          {
              SecurityToken token;
              tokendHandler.ValidateToken(jwtToken, validationParameters, out token);
  
             return token as JwtSecurityToken;
          }
          catch (Exception ex)
          {
              loggingService.LogError("Could not validate azure ad token", nameof(AzureSecurityService), ex);
              return null;
          }
      }
  
     public async Task&lt;string&gt; GenerateToken(string code)
      {
          AuthenticationContext authenticationContext = new AuthenticationContext(_authority);
  
         try
          {
              string baseUrl = HttpContext.Current.Request.Url.GetLeftPart(UriPartial.Authority);
              AuthenticationResult result =
                  await authenticationContext.AcquireTokenByAuthorizationCodeAsync(code, new Uri(baseUrl), new ClientCredential(_clientId, _clientSecret));
  
             return result.IdToken;
          }
          catch (AdalException adalex)
          {
              loggingService.LogError("Could not get authorization request url", nameof(AzureSecurityService), adalex);
              return null;
          }
          catch (Exception ex)
          {
              loggingService.LogError("Could not get authorization request url", nameof(AzureSecurityService), ex);
              return null;
          }
      }
  
     public async Task&lt;string&gt; GetAuthUrl()
      {
          AuthenticationContext authenticationContext = new AuthenticationContext(_authority);
  
         // Config for OAuth client credentials  
         try
          {
              string baseUrl = HttpContext.Current.Request.Url.GetLeftPart(UriPartial.Authority);
              var authUri =
                  await authenticationContext.GetAuthorizationRequestUrlAsync("00000000-0000-0000-0000-000000000000", _clientId, new Uri(baseUrl), UserIdentifier.AnyUser, null);
  
             return authUri.ToString();
          }
          catch (AdalException adalex)
          {
              loggingService.LogError("Could not get authorization request url", nameof(AzureSecurityService), adalex);
              return null;
          }
          catch (Exception ex)
          {
              loggingService.LogError("Could not get authorization request url", nameof(AzureSecurityService), ex);
              return null;
          }
      }
  </code></pre>
  
  <p><strong>UPDATE</strong></p>
  
  <p>So for whatever reason even though there was no scope being provided I was getting back claims. What I have done now is just add query parameters to the auth url for scope and request both openid and profile:</p>
  
  <pre><code>var authUri =
                  await authenticationContext.GetAuthorizationRequestUrlAsync("00000000-0000-0000-0000-000000000000", _clientId, new Uri(GetBaseUrl()), UserIdentifier.AnyUser, "scope=openid profile");
  </code></pre>
  
  <p>My question is now why does the default scope not return an id_token with a signature?</p>