Validating signing certificate when using OpenId Connect
<p>I'm trying to understand whether my Owin-hosted Web Api needs to validate the certificate used to sign a JWT-token.</p>

<p>I've set up an identity provider using <a href="https://github.com/IdentityServer/IdentityServer3" rel="nofollow">IdentityServer</a>.  On the "relying party"-side, I have an ASP.NET WebApi hosted using Owin. On the RP-side, I'm using UseOpenIdConnectAuthentication to install the OpenIdConnectAuthenticationMiddleware in the Owin pipeline.</p>

<p>What's working so far:</p>

<ol>
<li>Any unauthenticated user visiting my web app is redirected to the login page on IdentityServer</li>
<li>The user logs on</li>
<li>The user is redirected back to my web app</li>
<li>My web app receives the JWT containing the id token and access token</li>
<li>My web app calls the user info endpoint to retrieve the claims using the access token</li>
</ol>

<p>What I'm missing is logic to validate the certificate which was used to sign the JWT containing the identity token.</p>

<p>Using Fiddler, I've been able to see that the OpenIdConnectAuthenticationMiddleware retrieves the keys from the identity server (by calling <a href="https://myidentityserver.example.com/core/.well-known/jwks" rel="nofollow">https://myidentityserver.example.com/core/.well-known/jwks</a> HTTP/1.1)</p>

<p>Is the OpenIdConnectAuthenticationMiddleware performing some kind of validation of the certificate? Or should I be writing this code myself?</p>