IdentityServer4 Signature Authentication

Question

I have an IdentityServer4 that generates signed JWT tokens. In my web api, I added middleware to validate these tokens:

         app.UseIdentityServerAuthentication(new IdentityServerAuthenticationOptions
        {
            Authority = env.IsProduction() ? "https://www.example.com/api/" : "http://localhost/api/",
            AllowedScopes = { "WebAPI", "firm",
                IdentityServerConstants.StandardScopes.OpenId,
                IdentityServerConstants.StandardScopes.Profile },
            RequireHttpsMetadata = env.IsProduction(),
        });

It works great. However, I suspect that it does not verify the signature of the jwt token, because there is no public key configured to verify the token. How to configure token signature verification?

PS: instead, I'm trying to use UseJwtBearerAuthentication:

        var cert = new X509Certificate2("X509.pfx", "mypassword");
        var TokenValidationParameters = new TokenValidationParameters
        {
            ValidateIssuerSigningKey = true,
            ValidateIssuer = true,
            ValidIssuer = env.IsProduction() ? "https://www.example.com/api/" : "http://localhost/api/",
            IssuerSigningKey = new X509SecurityKey(cert),
        };
        app.UseJwtBearerAuthentication(new JwtBearerOptions
        {
            Authority = env.IsProduction() ? "https://www.wigwam3d.com/api/" : "http://localhost/api/",
            Audience = "WebAPI",
            RequireHttpsMetadata = env.IsProduction(),
            TokenValidationParameters = TokenValidationParameters
        });

It also works (and I hope it also checks the signature of the token!), But gives me another error:

UserManager.GetUserAsync(HttpContext.HttpContext.User)

returns null while UseIdentityServerAuthentication returns the correct user to me

Answer 1

, API . .UseIdentityServerAuthentication() IdentiyServer https://www.example.com/api/.well-known/openid-configuration. , , .

Answer 2

, JwtBearerAuthentication,

GetUserAsync ​​ :

JwtSecurityTokenHandler.DefaultInboundClaimTypeMap.Clear();

- : https://github.com/aspnet/Security/issues/1043

, IdentityServer auth, !