title: Azure AD Jwt Bearer token
body: <p>I am attempting to build an application with a SPA UI and a web API that uses Jwt Bearer tokens for access control. I can authenticate the user and send the bearer token to the web request,but when I do so I get the following error</p>
  
  <blockquote>
    <p>Bearer was not authenticated. Failure message: IDX10500: Signature
    validation failed. No security keys were provided to validate the
    signature.</p>
  </blockquote>
  
  <p>I want to the middleware to use the key set found in at </p>
  
  <p><a href="https://login.microsoftonline.com/common/discovery/keys" rel="nofollow noreferrer">https://login.microsoftonline.com/common/discovery/keys</a></p>
  
  <p>but I am clearly missing something. Below is the snippet of code in my startup to configure the bearer token. Can someone point out where I am going wrong?</p>
  
  <pre><code>    var clientId = Configuration["AzureAd:ClientId"];
      var tenantId = Configuration["AzureAd:TenantId"];
      var issuer = $"https://sts.windows.net/{tenantId}/";
  
      services.AddAuthentication(options =&gt;
      {
         options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
         options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
       })
        .AddJwtBearer(options =&gt;
        {
          options.RequireHttpsMetadata = false;
          options.SaveToken = true;
          options.Authority = "https://login.microsoftonline.com/common/";
  
          options.TokenValidationParameters = new TokenValidationParameters()
          {
              ValidateIssuer = true,
              ValidIssuer = issuer,
              ValidateAudience = true,
              ValidAudiences = new string[] { clientId },
              ValidateLifetime = true
          };
        });
  </code></pre>