Tukukkk

I am having some trouble manually validating a JWT token issued by Identity Server 4. Using the

ClientId: "CLIENT1"
ClientSecret: "123456"

The exception I keep getting is: IDX10501: Signature validation failed. Unable to match keys: '[PII is hidden by default. Set the 'ShowPII' flag in IdentityModelEventSource.cs to true to reveal it.]'

Is anyone able to advise me where I am going wrong.

    private static void ValidateJwt(string jwt, DiscoveryResponse disco)

    {        



        var parameters = new TokenValidationParameters

        {



            ValidateIssuerSigningKey = true,

            ValidIssuer = disco.Issuer,

            IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes("123456")),               

            ValidAudience = "CLIENT1",

            //IssuerSigningKeys = keys,

            // ValidateAudience = true,

            // ValidateLifetime = true,

        };



        SecurityToken validatedToken;

        var handler = new JwtSecurityTokenHandler();

        handler.InboundClaimTypeMap.Clear();



        try

        {

            var user = handler.ValidateToken(jwt, parameters, out validatedToken);

        }

        catch(Exception ex)

        {

            var error = ex.Message;

        }



    }

Check out ValidateJwt() in this sample:

https://github.com/IdentityServer/IdentityServer4.Samples/blob/master/Clients/src/MvcManual/Controllers/HomeController.cs

The bit you're missing is loading the public key from the discovery document.

IdentityServer signs the JWT using RS256. This means you need to use a public key to verify the JWT (you can get this from the discovery document).

The client id & client secret are client credentials used for requesting tokens. They have no part in validating them.

You are trying to use SymmetricKey for JWT validation. Try looking your token in JWT.io and if algorithm is"RS256" then SymmetricKey won't work.

You have specified:

IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes("secret"))

but the JwtSecurityTokenHandler could not match it with the key which can be part of jwt header itself. Basically it means that your configuration has mismatch[es] with configuration of the real issuer. The error suggests that this relates to the signature keys.

Please, check the configuration of that issuer (if you can), find out missed parts, and try again.

You can use jwt.io to debug your jwt online.