{"action":"created","issue":{"url":"https://api.github.com/repos/aspnet-contrib/AspNet.Security.OpenIdConnect.Server/issues/210","repository_url":"https://api.github.com/repos/aspnet-contrib/AspNet.Security.OpenIdConnect.Server","labels_url":"https://api.github.com/repos/aspnet-contrib/AspNet.Security.OpenIdConnect.Server/issues/210/labels{/name}","comments_url":"https://api.github.com/repos/aspnet-contrib/AspNet.Security.OpenIdConnect.Server/issues/210/comments","events_url":"https://api.github.com/repos/aspnet-contrib/AspNet.Security.OpenIdConnect.Server/issues/210/events","html_url":"https://github.com/aspnet-contrib/AspNet.Security.OpenIdConnect.Server/issues/210","id":135051076,"number":210,"title":"[Authorize] attribute redirect to /Account/Login","user":{"login":"dewebeloper","id":3725912,"avatar_url":"https://avatars.githubusercontent.com/u/3725912?v=3","gravatar_id":"","url":"https://api.github.com/users/dewebeloper","html_url":"https://github.com/dewebeloper","followers_url":"https://api.github.com/users/dewebeloper/followers","following_url":"https://api.github.com/users/dewebeloper/following{/other_user}","gists_url":"https://api.github.com/users/dewebeloper/gists{/gist_id}","starred_url":"https://api.github.com/users/dewebeloper/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dewebeloper/subscriptions","organizations_url":"https://api.github.com/users/dewebeloper/orgs","repos_url":"https://api.github.com/users/dewebeloper/repos","events_url":"https://api.github.com/users/dewebeloper/events{/privacy}","received_events_url":"https://api.github.com/users/dewebeloper/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/aspnet-contrib/AspNet.Security.OpenIdConnect.Server/labels/question","name":"question","color":"cc317c"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-02-20T09:07:39Z","updated_at":"2016-02-20T14:22:13Z","closed_at":null,"body":"I have implemented OpenIdConnectServer like \r\n```\r\napp.UseOpenIdConnectServer(options =>\r\n{\r\n        options.AllowInsecureHttp = true;\r\n        options.ApplicationCanDisplayErrors = true;\r\n\toptions.TokenEndpointPath = \"/token\";\r\n\toptions.AccessTokenLifetime = TimeSpan.FromMinutes(30);\r\n\toptions.AccessTokenFormat = new WbjwtFormat(issuer, ctx);\r\n\toptions.Provider = new AuthorizationServerProvider(ctx);\r\n});\r\n```\r\n\r\nAnd also have \r\n```\r\napp.UseJwtBearerAuthentication(options =>\r\n{\r\n\toptions.AutomaticAuthenticate = true;\r\n\toptions.Audience = audienceId;\r\n\toptions.Authority = authority ;\r\n\toptions.RequireHttpsMetadata = false;\r\n});\r\n```\r\n\r\non controller I have \r\n\r\n```\r\n[Route(\"api/companies\")]\r\n[Authorize]\r\npublic class CompaniesController : BaseController\r\n{}\r\n\r\n```\r\nFirst issue is when I make request without Authentication header I have been redirected to /Account/Login route.\r\nWhen I include Authentication header then all is fine, I get asked result.\r\n\r\nBut if my token has expired then I get \r\n`SecurityTokenInvalidSignatureException: IDX10503: Signature validation failed. Keys tried: 'System.IdentityModel.Tokens.RsaSecurityKey , KeyId: UQRP_TWJNGS4OHI3Z5ITEAP_FKBKQXC1W0UF7RLC`\r\n\r\n```\r\nSystem.IdentityModel.Tokens.Jwt.JwtSecurityTokenHandler.ValidateSignature(String token, TokenValidationParameters validationParameters)\r\nSystem.IdentityModel.Tokens.Jwt.JwtSecurityTokenHandler.ValidateToken(String token, TokenValidationParameters validationParameters, SecurityToken& validatedToken)\r\nMicrosoft.AspNet.Authentication.JwtBearer.JwtBearerHandler.<HandleAuthenticateAsync>d__1.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\nSystem.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\r\nMicrosoft.AspNet.Authentication.JwtBearer.JwtBearerHandler.<HandleAuthenticateAsync>d__1.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\nSystem.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\nSystem.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\nMicrosoft.AspNet.Authentication.AuthenticationHandler`1.<InitializeAsync>d__48.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\nSystem.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\nSystem.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\nMicrosoft.AspNet.Authentication.AuthenticationMiddleware`1.<Invoke>d__18.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\nSystem.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\nSystem.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\nMicrosoft.AspNet.Diagnostics.DeveloperExceptionPageMiddleware.<Invoke>d__7.MoveNext()\r\n```\r\n\r\nmy dependencies are \r\n\r\n```\r\n\"dependencies\": {\r\n\t\t\"Microsoft.AspNet.IISPlatformHandler\": \"1.0.0-rc1-final\",\r\n\t\t\"Microsoft.AspNet.Server.Kestrel\": \"1.0.0-rc1-final\",\r\n\t\t\"Microsoft.AspNet.StaticFiles\": \"1.0.0-rc1-final\",\r\n\t\t\"Microsoft.AspNet.Hosting\": \"1.0.0-rc1-final\",\r\n\t\t\"Microsoft.AspNet.Mvc\": \"6.0.0-rc1-final\",\r\n\t\t\"Microsoft.AspNet.Diagnostics\": \"1.0.0-rc1-final\",\r\n\t\t\"WhiteBee.CentralConfig.Data\": \"1.0.0-*\",\r\n\t\t\"EntityFramework.MicrosoftSqlServer\": \"7.0.0-rc1-final\",\r\n\t\t\"EntityFramework.SqlServerCompact40\": \"7.0.0-rc1-final\",\r\n\t\t\"EntityFramework.Commands\": \"7.0.0-rc1-final\",\r\n\t\t\"Microsoft.CSharp\": \"4.0.0\",\r\n\t\t\"Microsoft.AspNet.Identity\": \"3.0.0-rc1-final\",\r\n\t\t\"Microsoft.AspNet.Authentication.JwtBearer\": \"1.0.0-rc1-final\",\r\n\t\t\"AspNet.Security.OpenIdConnect.Server\": \"1.0.0-beta4\",\r\n\t\t\"AspNet.Security.OpenIdConnect.Extensions\": \"1.0.0-beta4\",\r\n\t\t\"Microsoft.AspNet.Security.DataProtection\": \"1.0.0-beta3\",\r\n\t\t\"WhiteBee.CentralConfig.Repo\": \"1.0.0-*\",\r\n\t\t\"Microsoft.AspNet.Mvc.TagHelpers\": \"6.0.0-rc1-final\",\r\n\t\t\"Microsoft.Owin.Security\": \"3.0.1\",\r\n\t\t\"Thinktecture.IdentityModel.Core\": \"1.4.0\"\r\n\t}\r\n\r\n```\r\n\r\nall that on x86 architeture"},"comment":{"url":"https://api.github.com/repos/aspnet-contrib/AspNet.Security.OpenIdConnect.Server/issues/comments/186614172","html_url":"https://github.com/aspnet-contrib/AspNet.Security.OpenIdConnect.Server/issues/210#issuecomment-186614172","issue_url":"https://api.github.com/repos/aspnet-contrib/AspNet.Security.OpenIdConnect.Server/issues/210","id":186614172,"user":{"login":"PinpointTownes","id":6998306,"avatar_url":"https://avatars.githubusercontent.com/u/6998306?v=3","gravatar_id":"","url":"https://api.github.com/users/PinpointTownes","html_url":"https://github.com/PinpointTownes","followers_url":"https://api.github.com/users/PinpointTownes/followers","following_url":"https://api.github.com/users/PinpointTownes/following{/other_user}","gists_url":"https://api.github.com/users/PinpointTownes/gists{/gist_id}","starred_url":"https://api.github.com/users/PinpointTownes/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/PinpointTownes/subscriptions","organizations_url":"https://api.github.com/users/PinpointTownes/orgs","repos_url":"https://api.github.com/users/PinpointTownes/repos","events_url":"https://api.github.com/users/PinpointTownes/events{/privacy}","received_events_url":"https://api.github.com/users/PinpointTownes/received_events","type":"User","site_admin":false},"created_at":"2016-02-20T14:22:13Z","updated_at":"2016-02-20T14:22:13Z","body":"> First issue is when I make request without Authentication header I have been redirected to /Account/Login route.\r\nWhen I include Authentication header then all is fine, I get asked result.\r\n\r\nhttps://github.com/openiddict/openiddict-core/issues/58\r\n\r\n> But if my token has expired then I get \r\nSecurityTokenInvalidSignatureException: IDX10503: Signature validation failed. Keys tried: 'System.IdentityModel.Tokens.RsaSecurityKey , KeyId: UQRP_TWJNGS4OHI3Z5ITEAP_FKBKQXC1W0UF7RLC\r\n\r\nThis exception happens when the signing key exposed by the JWKS endpoint doesn't correspond to the key used to sign the token. Are you using ASOS in a distributed environment? You should also share your `WbjwtFormat`, to make sure you're not missing something obvious."}}