{"action":"opened","issue":{"url":"https://api.github.com/repos/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/issues/181","labels_url":"https://api.github.com/repos/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/issues/181/labels{/name}","comments_url":"https://api.github.com/repos/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/issues/181/comments","events_url":"https://api.github.com/repos/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/issues/181/events","html_url":"https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/issues/181","id":88474529,"number":181,"title":"NamedKeySecurityKeyIdentifierClause are NOT resolved a X509ThumbprintKeyIdentifierClause fails to resolve","user":{"login":"brentschmaltz","id":3172421,"avatar_url":"https://avatars.githubusercontent.com/u/3172421?v=3","gravatar_id":"","url":"https://api.github.com/users/brentschmaltz","html_url":"https://github.com/brentschmaltz","followers_url":"https://api.github.com/users/brentschmaltz/followers","following_url":"https://api.github.com/users/brentschmaltz/following{/other_user}","gists_url":"https://api.github.com/users/brentschmaltz/gists{/gist_id}","starred_url":"https://api.github.com/users/brentschmaltz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/brentschmaltz/subscriptions","organizations_url":"https://api.github.com/users/brentschmaltz/orgs","repos_url":"https://api.github.com/users/brentschmaltz/repos","events_url":"https://api.github.com/users/brentschmaltz/events{/privacy}","received_events_url":"https://api.github.com/users/brentschmaltz/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-06-15T16:26:27Z","updated_at":"2015-06-15T16:26:27Z","closed_at":null,"body":"The following exception is hit when the runtime fails to resolve the X509Clause even though the kid matches the NamedKeyIdentifierClause.\r\n\r\nSystem.IdentityModel.Tokens.SecurityTokenSignatureKeyNotFoundException: IDX10500: Signature validation failed. Unable to resolve SecurityKeyIdentifier: 'SecurityKeyIdentifier\r\n    (\r\n    IsReadOnly = False,\r\n    Count = 2,\r\n    Clause[0] = X509ThumbprintKeyIdentifierClause(Hash = 0xE53906B4A46481A89ECC463612C2C2DA038B8C0E),\r\n    Clause[1] = System.IdentityModel.Tokens.NamedKeySecurityKeyIdentifierClause\r\n    )\r\n', \r\ntoken: '{\"typ\":\"JWT\",\"alg\":\"RS256\",\"x5t\":\"5TkGtKRkgaiezEY2EsLC2gOLjA4\",\"kid\":\"5TkGtKRkgaiezEY2EsLC2gOLjA4\"}.{\"aud\":\"https://ecgodata.cloudapp.net\",\"iss\":\"https://sts.windows-ppe.net/f686d426-8d16-42db-81b7-ab578e110ccd/\",\"iat\":1429026545,\"nbf\":1429026545,\"exp\":1429030445,\"ver\":\"1.0\",\"tid\":\"f686d426-8d16-42db-81b7-ab578e110ccd\",\"oid\":\"96f1c1dc-d7c1-4fd2-9a55-145e627c6775\",\"upn\":\"micsmi@microsoft.com\",\"puid\":\"10033FFF801B7E44\",\"sub\":\"0Ki9crCxnR1hvLtkjzs7HKT7Z5BLLAfemrQRVdHdc_Y\",\"given_name\":\"Micah\",\"family_name\":\"Smith\",\"name\":\"Micah Smith\",\"amr\":[\"pwd\"],\"unique_name\":\"micsmi@microsoft.com\",\"appid\":\"a672d62c-fc7b-4e81-a576-e60dc46e951d\",\"appidacr\":\"0\",\"scp\":\"user_impersonation\",\"acr\":\"1\"}'.\r\n   at System.IdentityModel.Tokens.JwtSecurityTokenHandler.ValidateSignature(String token, TokenValidationParameters validationParameters)\r\n   at System.IdentityModel.Tokens.JwtSecurityTokenHandler.ValidateToken(String securityToken, TokenValidationParameters validationParameters, SecurityToken& validatedToken)\r\n   at Microsoft.Owin.Security.Jwt.JwtFormat.Unprotect(String protectedText)\r\n   at Microsoft.Owin.Security.Infrastructure.AuthenticationTokenReceiveContext.DeserializeTicket(String protectedData)\r\n   at Microsoft.Owin.Security.OAuth.OAuthBearerAuthenticationHandler.<AuthenticateCoreAsync>d__0.MoveNext()\r\nThe thread 0x1e4 has exited with code 259 (0x103).\r\n"}}