title: Custom SecurityTokenValidator works but still unauthorized
body: <p>I'm having some troubles in dotnet core with JWT validation.</p>
  
  <p>I have created a custom validator, instead of validating the token, it will be forwarded to another API and return the token. This works perfectly, however, I keep getting the response: unauthorized.</p>
  
  <p>This is my validator, quite simple, it validates the token, if it gets a response, it should be okay.</p>
  
  <pre><code>public class JwtValidator : ISecurityTokenValidator
  {
      AuthenticationClient authClient;
  
      public JwtValidator(AuthenticationClient authClient)
      {
          this.authClient = authClient;
      }
  
      public bool CanValidateToken =&gt; true;
  
      public int MaximumTokenSizeInBytes { get =&gt; throw new NotImplementedException(); set =&gt; throw new NotImplementedException(); }
  
      public bool CanReadToken(string securityToken)
      {
          return true;
      }
  
      public ClaimsPrincipal ValidateToken(string securityToken, TokenValidationParameters validationParameters, out SecurityToken validatedToken)
      {
          validatedToken = null;
  
          //your logic here
          var response = authClient.Validate(securityToken);
          //assuming response will contain info about the user
  
          if (response == null)
              throw new SecurityTokenException("invalid");
  
          validatedToken = response.Result;
  
          return new ClaimsPrincipal(new ClaimsIdentity(response.Result.Claims));
  }
  </code></pre>
  
  <p>No exception is being thrown, the token is valid, claims are being returned.</p>
  
  <p>In Startup.cs I have the following code:</p>
  
  <pre><code>services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
          .AddJwtBearer(options =&gt;
          {
              options.SecurityTokenValidators.Clear();
              options.SecurityTokenValidators.Add(new JwtValidator(authClient));
          });
  </code></pre>
  
  <p>When I add logging to the JwtValidator I do get logs, so the function appears to be called correctly. But the API keeps returning "Unauthorized".</p>