title: Multiple JWT authorities/issuers in Asp.Net Core
body: <p>I'm trying to get JWT bearer authentication in an ASP.Net API gateway using Ocelot to work with multiple authorities/issuers. One issuer is Auth0 and the other is an in-house authentication server based on IdentityServer4; we are trying to migrate away from Auth0 but have external clients that still depend on it, so we would like to support both until everything is fully tested for them to switch.</p>
  <p>According to <a href="https://blogs.msdn.microsoft.com/webdev/2017/04/06/jwt-validation-and-authorization-in-asp-net-core/" rel="noreferrer">this MSDN blog post</a>, it should be possible to use multiple authorities by setting <code>TokenValidationParameters.ValidIssuers</code> instead of <code>JwtBearerOptions.Authority</code>. However, I have tested this with and without Ocelot and no authentication occurs if the Authority is not set to the authority who issued the token, no matter the contents of <code>TokenValidationParameters.ValidIssuers</code>.</p>
  <p>Does anybody know how to get this working? This is how I'm setting up authentication. It works only if the commented line is uncommented (and only for tokens issued by that single authority). I'm expecting Ocelot or ASP.Net Core to get the key from the issuing server; both provide JWKs by .well-known/openid-configuration which works with the ASP.Net Core middleware.</p>
  <pre class="lang-cs prettyprint-override"><code>public static void AddJwtBearerAuthentication(this IServiceCollection services, IConfiguration configuration)
  {
      services
          .AddAuthentication(options =&gt;
          {
              options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
              options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
          })
          .AddJwtBearer(JwtBearerDefaults.AuthenticationScheme, options =&gt;
          {
              //options.Authority = configuration[&quot;Jwt:Authority&quot;];
              options.Audience  = configuration[&quot;Jwt:Audience&quot;];
              options.TokenValidationParameters = new TokenValidationParameters
              {
                  ValidateIssuer           = true,
                  ValidateIssuerSigningKey = true,
                  ValidateAudience         = true,
                  ValidAudience            = configuration[&quot;Jwt:Audience&quot;],
                  ValidIssuers             = configuration
                      .GetSection(&quot;Jwt:Authorities&quot;)
                      .AsEnumerable()
                      .Select(kv =&gt; kv.Value)
                      .Where(s =&gt; !string.IsNullOrEmpty(s))
                      .ToArray()
              };
          });
  }
  </code></pre>
  <p>The output of Ocelot when a client who has the wrong issuer (or when we're using <code>TokenValidationParameters.ValidIssuer</code>/<code>ValidIssuers</code>) connects is:</p>
  <pre><code>[16:35:37 WRN] requestId: _____, previousRequestId: no previous request id, message: Error Code: UnauthenticatedError Message: Request for authenticated route _____ by  was unauthenticated errors found in ResponderMiddleware. Setting error response for request path:_____, request method: POST
  </code></pre>
  <p>This is a client_credentials authentication hence the lack of a username after &quot;by&quot;. As you can see Ocelot doesn't say what the exact problem is. The ASP.Net Core JWT bearer middleware (without Ocelot) just says the signature is invalid. I suspect it either isn't looking at the <code>TokenValidationParameters</code>, or I've misunderstood the purpose of them.</p>