{"action":"created","issue":{"url":"https://api.github.com/repos/aspnet/Security/issues/572","labels_url":"https://api.github.com/repos/aspnet/Security/issues/572/labels{/name}","comments_url":"https://api.github.com/repos/aspnet/Security/issues/572/comments","events_url":"https://api.github.com/repos/aspnet/Security/issues/572/events","html_url":"https://github.com/aspnet/Security/issues/572","id":115958268,"number":572,"title":"beta 7 > beta 8  - JWT SecurityTokenValidators","user":{"login":"dynamiclynk","id":621804,"avatar_url":"https://avatars.githubusercontent.com/u/621804?v=3","gravatar_id":"","url":"https://api.github.com/users/dynamiclynk","html_url":"https://github.com/dynamiclynk","followers_url":"https://api.github.com/users/dynamiclynk/followers","following_url":"https://api.github.com/users/dynamiclynk/following{/other_user}","gists_url":"https://api.github.com/users/dynamiclynk/gists{/gist_id}","starred_url":"https://api.github.com/users/dynamiclynk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dynamiclynk/subscriptions","organizations_url":"https://api.github.com/users/dynamiclynk/orgs","repos_url":"https://api.github.com/users/dynamiclynk/repos","events_url":"https://api.github.com/users/dynamiclynk/events{/privacy}","received_events_url":"https://api.github.com/users/dynamiclynk/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-11-09T20:25:22Z","updated_at":"2015-11-09T20:33:26Z","closed_at":"2015-11-09T20:33:25Z","body":"So prior to Beta 8 in Beta 7 I had the below code in my StartUp.ConfigureServices method, but since the Bearer configuration was moved to the Configure method, the **ValidateToken** in my Custom JwtTokenValidator no longer fires.\r\n\r\n**This is what I had prior to beta 8**\r\n     \r\n\r\n\r\n\r\n        public static void ConfigureTokenValidation(IServiceCollection services, string appName)\r\n        {\r\n            services.ConfigureOAuthBearerAuthentication(config =>\r\n            {\r\n                config.TokenValidationParameters.ValidateAudience = true;\r\n                config.TokenValidationParameters.ValidateIssuer = true;\r\n                config.TokenValidationParameters.RequireExpirationTime = true;\r\n                config.TokenValidationParameters.ValidateLifetime = true;\r\n                config.TokenValidationParameters.RequireSignedTokens = true;\r\n                config.TokenValidationParameters.ValidateIssuerSigningKey = true;\r\n                config.TokenValidationParameters.ValidateSignature = true;\r\n                config.SecurityTokenValidators = new List<ISecurityTokenValidator>\r\n                {\r\n                    new CustomSecurityTokenValidator(appName)\r\n                };\r\n            });\r\n        }\r\n\r\n**Now (ValidateToken not firing)**\r\n    \r\n\r\n\r\n\r\n        public static void UseJwtBearerValidation(IApplicationBuilder app, string appName)\r\n        {\r\n            app.UseJwtBearerAuthentication(config =>\r\n            {\r\n                config.AutomaticAuthentication = true;\r\n                config.TokenValidationParameters.ValidateAudience = true;\r\n                config.TokenValidationParameters.ValidateIssuer = true;\r\n                config.TokenValidationParameters.RequireExpirationTime = true;\r\n                config.TokenValidationParameters.ValidateLifetime = true;\r\n                config.TokenValidationParameters.RequireSignedTokens = true;\r\n                config.TokenValidationParameters.ValidateIssuerSigningKey = true;\r\n                config.TokenValidationParameters.ValidateSignature = true;\r\n               \r\n                //now a readonly list prop\r\n                config.SecurityTokenValidators.Add(new CustomSecurityTokenValidator(appName));\r\n            });\r\n        }\r\n\r\nCustomSecurityTokenValidator is a custom class that handles all of JWT issuer, key, expiration, etc. Inherits from JwtSecurityTokenHandler in System.IdentityModel.Tokens.Jwt.\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/aspnet/Security/issues/comments/155184897","html_url":"https://github.com/aspnet/Security/issues/572#issuecomment-155184897","issue_url":"https://api.github.com/repos/aspnet/Security/issues/572","id":155184897,"user":{"login":"dynamiclynk","id":621804,"avatar_url":"https://avatars.githubusercontent.com/u/621804?v=3","gravatar_id":"","url":"https://api.github.com/users/dynamiclynk","html_url":"https://github.com/dynamiclynk","followers_url":"https://api.github.com/users/dynamiclynk/followers","following_url":"https://api.github.com/users/dynamiclynk/following{/other_user}","gists_url":"https://api.github.com/users/dynamiclynk/gists{/gist_id}","starred_url":"https://api.github.com/users/dynamiclynk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dynamiclynk/subscriptions","organizations_url":"https://api.github.com/users/dynamiclynk/orgs","repos_url":"https://api.github.com/users/dynamiclynk/repos","events_url":"https://api.github.com/users/dynamiclynk/events{/privacy}","received_events_url":"https://api.github.com/users/dynamiclynk/received_events","type":"User","site_admin":false},"created_at":"2015-11-09T20:33:25Z","updated_at":"2015-11-09T20:33:25Z","body":"@Tratcher You are my hero :) Yep all good now. closed."}}