SecurityTokenSignatureKeyNotFoundException: IDX10503: Signature validation failed. about active-directory-aspnetcore-webapp-openidconnect-v2 HOT 1 OPEN

I found a post on techcommunity.microsoft.com that shed light and helped me to resolve this issue.

ID token issued by AAD does not match public sign key

Basically, just add "?appid={your-app-guid}" to the well know openid configuration link used for metadata address. This is needed when custom claim mappings are configured in your application.

Example:

builder.Services.AddAuthentication(OpenIdConnectDefaults.AuthenticationScheme)
.AddMicrosoftIdentityWebApp(opt =>
{
builder.Configuration.Bind("AzureAd", opt);
opt.MetadataAdrress = $"{opt.Instance}/{opt.TenantId}/v2.0/.well-known/openid-configuration?appid={opt.ClientId}";
});

Hope this helps somebody.

from active-directory-aspnetcore-webapp-openidconnect-v2.