title: OAuth Bearer token Authentication is not passing signature validation
body: <p>I get the following error on the token consumer. Any help resolving this will be most appreciated. Thanks.</p>
  
  <hr>
  
  <blockquote>
    <p>"IDX10503: Signature validation failed. </p>
    
    <p>Keys tried:
    'System.IdentityModel.Tokens.SymmetricSecurityKey  '. Exceptions
    caught: 'System.InvalidOperationException: IDX10636:
    SignatureProviderFactory.CreateForVerifying returned null for key:
    'System.IdentityModel.Tokens.SymmetricSecurityKey',
    signatureAlgorithm:
    '<a href="http://www.w3.org/2001/04/xmldsig-more#hmac-sha256" rel="nofollow">http://www.w3.org/2001/04/xmldsig-more#hmac-sha256</a>'.  at
    Microsoft.IdentityModel.Logging.LogHelper.Throw(String message, Type
    exceptionType, EventLevel logLevel, Exception innerException)  at
    System.IdentityModel.Tokens.JwtSecurityTokenHandler.ValidateSignature(Byte[]
    encodedBytes, Byte[] signature, SecurityKey key, String algorithm)  at
    System.IdentityModel.Tokens.JwtSecurityTokenHandler.ValidateSignature(String
    token, TokenValidationParameters validationParameters)  '. token:
    'token info was here'"</p>
  </blockquote>
  
  <p><strong>Token Generation Code on OAuth server</strong></p>
  
  <pre><code> using (var ctlr = new EntityController())
          {
              var authRepo = ctlr.GetAuthModelRepository();
  
              string clientId;
  
              ticket.Properties.Dictionary.TryGetValue(WebConstants.OwinContextProps.OAuthClientIdPropertyKey, out clientId);
  
              if (string.IsNullOrWhiteSpace(clientId))
              {
                  throw new InvalidOperationException("AuthenticationTicket.Properties does not include audience");
              }
  
  
              //audience record
              var client = authRepo.FindAuthClientByOAuthClientID(clientId);
  
              var issued = ticket.Properties.IssuedUtc;
              var expires = ticket.Properties.ExpiresUtc;
  
  
              var hmac = new HMACSHA256(Convert.FromBase64String(client.Secret));
              var signingCredentials = new SigningCredentials(
                  new InMemorySymmetricSecurityKey(hmac.Key),
                  Algorithms.HmacSha256Signature, Algorithms.Sha256Digest);
  
              TokenValidationParameters validationParams =
                  new TokenValidationParameters()
                  {
                      ValidAudience = clientId,
                      ValidIssuer = _issuer,
                      ValidateLifetime = true,
                      ValidateAudience = true,
                      ValidateIssuer = true,
                      RequireSignedTokens = true,
                      RequireExpirationTime = true,
                      ValidateIssuerSigningKey = true,
                      IssuerSigningToken = new BinarySecretSecurityToken(hmac.Key)
                  };
  
              var jwtHandler = new JwtSecurityTokenHandler();
  
              var jwt = new JwtSecurityToken(_issuer, clientId, ticket.Identity.Claims, issued.Value.UtcDateTime, expires.Value.UtcDateTime, signingCredentials);
  
              jwtOnTheWire = jwtHandler.WriteToken(jwt);
  
              SecurityToken validatedToken = null;
              jwtHandler.ValidateToken(jwtOnTheWire, validationParams,out validatedToken);
              if (validatedToken == null)
                  return "token_validation_failed";
  
          }
          return jwtOnTheWire;
  </code></pre>
  
  <p><strong>Token Consumption\validation ASP.Net 5 vNext site within Owin Startup.cs</strong></p>
  
  <p><em>public void ConfigureServices(IServiceCollection services)</em></p>
  
  <pre><code>services.ConfigureOAuthBearerAuthentication(config =&gt;
          {
  
              //oauth validation
              var clientSecret = "not the real secret";
  
              var hmac = new HMACSHA256(Convert.FromBase64String(clientSecret));
              var signingCredentials = new SigningCredentials(
                  new SymmetricSecurityKey(hmac.Key), Algorithms.HmacSha256Signature, Algorithms.Sha256Digest);
  
              config.TokenValidationParameters.ValidAudience = "myappname";
              config.TokenValidationParameters.ValidIssuer = "mydomain.com";
              config.TokenValidationParameters.RequireSignedTokens = true;
              config.TokenValidationParameters.RequireExpirationTime = true;
              config.TokenValidationParameters.ValidateLifetime = true;
              config.TokenValidationParameters.ValidateIssuerSigningKey = true;
              config.TokenValidationParameters.ValidateSignature = true;
              config.TokenValidationParameters.ValidateAudience = true;
              config.TokenValidationParameters.IssuerSigningKey = signingCredentials.SigningKey;
          });
  </code></pre>
  
  <p><em>public void Configure(IApplicationBuilder app)</em></p>
  
  <pre><code>app.UseOAuthBearerAuthentication(config =&gt;
              {
  
                  config.AuthenticationScheme = "Bearer";
                  config.AutomaticAuthentication = true;
              });
  </code></pre>