IDX10500 error when calling Sitecore with JWT token from Postman after updating identity server certificate

Question

I am using Sitecore 9.1 and have recently updated my .pfx identity server certificates in Azure, due to the old ones expiring. After updating the Sitecore.IdentityServer.Host.xml configuration, the identity server issues JWTs with the correct kid. However, when I call my Sitecore API from Postman with a new JWT in the authorization header, Sitecore logs the following error:

ERROR Microsoft.Owin.Security.OAuth.OAuthBearerAuthenticationMiddleware - Authentication failed

Exception: Microsoft.IdentityModel.Tokens.SecurityTokenInvalidSignatureException

Message: IDX10500: Signature validation failed. No security keys were provided to validate the signature.

Source: System.IdentityModel.Tokens.Jwt at System.IdentityModel.Tokens.Jwt.JwtSecurityTokenHandler.ValidateSignature(String token, TokenValidationParameters validationParameters)

at System.IdentityModel.Tokens.Jwt.JwtSecurityTokenHandler.ValidateToken(String token, TokenValidationParameters validationParameters, SecurityToken& validatedToken)

at Microsoft.Owin.Security.Jwt.JwtFormat.Unprotect(String protectedText)

at Microsoft.Owin.Security.OAuth.OAuthBearerAuthenticationHandler.d__0.MoveNext()

The new certificate has been correctly imported on Sitecore app service, so I'm thinking perhaps I need to update some configuration value somewhere. However, the only configuration values I can seem to find are in App_Config\ConnectionStrings.config where some of the xconnect connection strings contain the thumbprint of the old certificate. Are there any configurations I need to update with the thumbprint of my new certificate or something else I am missing?

Answer 1

We have had exact same issue and our scenario was similar

1. We were using actual certificates and we found out that for internal roles we could user self signed certificates and hence we generated self signed certificate
2. Updated its signature in all config file including the one above which you showed "Sitecore.IdentityServer.Host.xml"
3. After restarting all instance, we were getting "Exception: Error occured" while login into CM and in logs we were getting those JWT token logs
4. Using postman it was working just fine and giving us the token so issue was not with that
5. We found out that identity server is not working with self signed certificate and it needs the actual certificate so we reverted that change for identity server and restarted apps

and everything started working for us, so basically for us it was the identity server and self signed certificate issue

Hope it helps