title: Owin/Katana UseJwtBearerAuthentication Always Returns 401
body: <p>I need to implement JWT Bearer Authentication in both a .NET 4.6.1 Web API project, as well as a .NET Core 2.0 web project. </p>
  
  <p>I successfully got the core project up and running with the this <a href="https://docs.microsoft.com/en-us/aspnet/core/migration/1x-to-2x/identity-2x#jwt-bearer-authentication" rel="nofollow noreferrer">sample</a> from Microsoft.</p>
  
  <p>I'm following this <a href="https://odetocode.com/blogs/scott/archive/2015/01/15/using-json-web-tokens-with-katana-and-webapi.aspx" rel="nofollow noreferrer">sample</a> from Scott Allen for the .NET 4.6.1 project.</p>
  
  <p>My 4.6.1 code looks like this:</p>
  
  <pre><code>public void ConfigureAuth(IAppBuilder app)
      {
          // Application requuires AD Bearer tokens for access
          app.UseJwtBearerAuthentication(
              new JwtBearerAuthenticationOptions
              {
                  AuthenticationMode = AuthenticationMode.Active,
                  TokenValidationParameters = new TokenValidationParameters
                  {
                      ValidIssuer = "https://validissuer.blahblah.com/",
                      ValidAudience = "https://validaudience.blahblah.com"
                  }
              });
      }
  </code></pre>
  
  <p>The same token will correctly validate in the .NET Core API, but not the .NET 4.6.1 API, and I believe I'm missing something minor. Any ideas?</p>
  
  <p>Side question: What are the best practices for what should be validated in a production environment? Both instances attempt to validate the issuer and audience, but should I consider validating anything else?</p>
  
  <p>-Tim</p>