I have been following this guide to set up integration with Azure AD. I have configured the AD in Azure portal as mentioned in the guide. I have configured the IDs of tenant, application and the groups from the Azure AD in Sitecore config files. The groups from Azure are mapped to roles via claims and the roles have been created in Sitecore.
When I try to access Sitecore, I am correctly redirected to the login page of my organization. When I log in, I am redirected back to the Sitecore identity server at https://mydomain.local/signin-oidc - here I get a 500-response saying
Microsoft.IdentityModel.Tokens.SecurityTokenSignatureKeyNotFoundException: IDX10501: Signature validation failed. Unable to match keys
Do anyone recognize this error and know what to do? Am I missing some configuration in Azure? In Sitecore?
The integration with an Azure AD has worked in our solution before: Recently, the organization changed to another Azure tenant and we there had to re-configure to this new AD, that we are using now. After making the changes described above, the error started to appear.
The complete error found in the Sitecore Identity server's log is:
2020-03-20T08:17:22.2766832+01:00 [DBG] (Sitecore STS/IMMEOWIN2016) Received 'id_token'
2020-03-20T08:17:22.2776766+01:00 [ERR] (Sitecore STS/IMMEOWIN2016) Exception occurred while processing message.
Microsoft.IdentityModel.Tokens.SecurityTokenSignatureKeyNotFoundException: IDX10501: Signature validation failed. Unable to match keys: '[PII is hidden by default. Set the 'ShowPII' flag in IdentityModelEventSource.cs to true to reveal it.]',
token: '[PII is hidden by default. Set the 'ShowPII' flag in IdentityModelEventSource.cs to true to reveal it.]'.
at System.IdentityModel.Tokens.Jwt.JwtSecurityTokenHandler.ValidateSignature(String token, TokenValidationParameters validationParameters)
at System.IdentityModel.Tokens.Jwt.JwtSecurityTokenHandler.ValidateToken(String token, TokenValidationParameters validationParameters, SecurityToken& validatedToken)
at Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler.ValidateToken(String idToken, AuthenticationProperties properties, TokenValidationParameters validationParameters, JwtSecurityToken& jwt)
at Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler.HandleRemoteAuthenticateAsync()
2020-03-20T08:17:22.2781255+01:00 [DBG] (Sitecore STS/IMMEOWIN2016) Exception of type 'SecurityTokenSignatureKeyNotFoundException' thrown, Options.ConfigurationManager.RequestRefresh() called.
2020-03-20T08:17:22.2781664+01:00 [INF] (Sitecore STS/IMMEOWIN2016) Error from RemoteAuthentication: "IDX10501: Signature validation failed. Unable to match keys: '[PII is hidden by default. Set the 'ShowPII' flag in IdentityModelEventSource.cs to true to reveal it.]',
token: '[PII is hidden by default. Set the 'ShowPII' flag in IdentityModelEventSource.cs to true to reveal it.]'.".
2020-03-20T08:17:22.2783160+01:00 [ERR] (Sitecore STS/IMMEOWIN2016) Connection id ""0HLUC2PLG5LIS"", Request id ""0HLUC2PLG5LIS:00000009"": An unhandled exception was thrown by the application.
System.Exception: An error was encountered while handling the remote login. --->
Microsoft.IdentityModel.Tokens.SecurityTokenSignatureKeyNotFoundException: IDX10501: Signature validation failed. Unable to match keys: '[PII is hidden by default. Set the 'ShowPII' flag in IdentityModelEventSource.cs to true to reveal it.]',
token: '[PII is hidden by default. Set the 'ShowPII' flag in IdentityModelEventSource.cs to true to reveal it.]'.
at System.IdentityModel.Tokens.Jwt.JwtSecurityTokenHandler.ValidateSignature(String token, TokenValidationParameters validationParameters)
at System.IdentityModel.Tokens.Jwt.JwtSecurityTokenHandler.ValidateToken(String token, TokenValidationParameters validationParameters, SecurityToken& validatedToken)
at Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler.ValidateToken(String idToken, AuthenticationProperties properties, TokenValidationParameters validationParameters, JwtSecurityToken& jwt)
at Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler.HandleRemoteAuthenticateAsync()
--- End of inner exception stack trace ---
at Microsoft.AspNetCore.Authentication.RemoteAuthenticationHandler`1.HandleRequestAsync()
at IdentityServer4.Hosting.FederatedSignOut.AuthenticationRequestHandlerWrapper.HandleRequestAsync()
at Microsoft.AspNetCore.Authentication.AuthenticationMiddleware.Invoke(HttpContext context)
at Microsoft.AspNetCore.Cors.Infrastructure.CorsMiddleware.Invoke(HttpContext context)
at IdentityServer4.Hosting.BaseUrlMiddleware.Invoke(HttpContext context)
at Microsoft.AspNetCore.Server.IISIntegration.IISMiddleware.Invoke(HttpContext httpContext)
at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.Http.HttpProtocol.ProcessRequests[TContext](IHttpApplication`1 application)
