title: Cannot validate AAD access token - IDX10511: Signature validation failed
body: <p>I am trying to build a method which validates my tokens. I am retrieving my tokens from Azure Active Directory with Open Id Connect Authorization Code Flow. The tokens that I get are the <strong>access_token</strong> and the <strong>id_token</strong>. I am using .NET Core.</p>
  
  <p>My validation code is as follows:</p>
  
  <pre class="lang-cs prettyprint-override"><code>string stsDiscoveryEndpoint = "https://login.microsoftonline.com/common/v2.0/.well-known/openid-configuration";
  var handler = new JwtSecurityTokenHandler();
  ConfigurationManager&lt;OpenIdConnectConfiguration&gt; configManager = new ConfigurationManager&lt;OpenIdConnectConfiguration&gt;(stsDiscoveryEndpoint, new OpenIdConnectConfigurationRetriever());
  OpenIdConnectConfiguration config = configManager.GetConfigurationAsync().Result;
  
  try
  {
    TokenValidationParameters validationParameters = new TokenValidationParameters
    {
       ValidIssuers = new [] { "https://login.microsoftonline.com/tenantid/v2.0" },
       ValidAudiences = new [] { "client-Id" },
       ValidateAudience = true,
       ValidateIssuer = true,
       IssuerSigningKeys = config.SigningKeys,
       ValidateLifetime = true
    };
    var tokenHandler = new JwtSecurityTokenHandler();
    SecurityToken validatedToken = null;
    tokenHandler.ValidateToken(token.AccessToken, validationParameters, out validatedToken);
    return validatedToken != null;
   }
   catch (SecurityTokenInvalidSignatureException ex)
   {
     return false;
   }
   catch(SecurityTokenValidationException)
   {
     return false;
   }
  </code></pre>
  
  <p>The code below <strong>works</strong> for the <strong>id_token</strong> BUT
  <strong>does not work</strong> for the <strong>access_token</strong></p>
  
  <p>The error message which I am getting when this method is executed for the access_token is:</p>
  
  <p><strong>IDX10511: Signature validation failed. Keys tried: 'Microsoft.IdentityModel.Tokens.X509SecurityKey , KeyId: CtAAALb-8NsDe333734859crfOc
  '. 
  kid: 'CtAAALb-8NsDe333734859crfOc'. 
  Exceptions caught:
   ' '</strong></p>