title: Does AddJwtBearer() Do what I think it does?
body: <p>I am trying to determine if the JwtBearer Service provided for .net core 3.0, does it actually use the asymettric signing key that is provided by my oidc providers well known configuration???</p>
  
  <p>I can't find any documentation around this.</p>
  
  <pre><code>.AddJwtBearer(opt =&gt;
                      {
                          opt.Authority = "http://localhost:8180/auth/realms/master";
                          opt.TokenValidationParameters = new Microsoft.IdentityModel.Tokens.TokenValidationParameters
                          {
                              ValidateIssuer = true,
                              ValidateAudience = false,
                              ValidateLifetime = true,
                              ValidateIssuerSigningKey = true
                          };
  </code></pre>
  
  <p>I am using Keycloak 4.8.3 as my oidc provider. The closest documentation I could find was here. <a href="https://developer.okta.com/blog/2018/03/23/token-authentication-aspnetcore-complete-guide" rel="noreferrer">https://developer.okta.com/blog/2018/03/23/token-authentication-aspnetcore-complete-guide</a></p>
  
  <p>The relevant piece is here:</p>
  
  <blockquote>
    <p>If you let the JwtBearer middleware auto-configure via the discovery document, this all works automatically!</p>
  </blockquote>
  
  <p>Did that above code do all that? Is this still relevant in 3.0 since we don't register the middleware anymore??</p>
  
  <p>I bet a lot of people don't know about Asymetric Signing keys, and why they are so important. We have abstracted away so much from the developer, that now I don't even know if my api is secure.</p>
  
  <p>So the final question is. <code>Does the .AddJwtBearer service with "ValidateIssuerSigningKey" periodically check the wellknown or whatever discovery document to grab the latest asymettric signing key?</code></p>