I am using Sitecore 9.1 and have recently updated my .pfx identity server certificates in Azure, due to the old ones expiring. After updating the Sitecore.IdentityServer.Host.xml configuration, the identity server issues JWTs with the correct kid. However, when I call my Sitecore API from Postman with a new JWT in the authorization header, Sitecore logs the following error:

ERROR Microsoft.Owin.Security.OAuth.OAuthBearerAuthenticationMiddleware - Authentication failed

Exception: Microsoft.IdentityModel.Tokens.SecurityTokenInvalidSignatureException

Message: IDX10500: Signature validation failed. No security keys were provided to validate the signature.

Source: System.IdentityModel.Tokens.Jwt at System.IdentityModel.Tokens.Jwt.JwtSecurityTokenHandler.ValidateSignature(String token, TokenValidationParameters validationParameters)

at System.IdentityModel.Tokens.Jwt.JwtSecurityTokenHandler.ValidateToken(String token, TokenValidationParameters validationParameters, SecurityToken& validatedToken)

at Microsoft.Owin.Security.Jwt.JwtFormat.Unprotect(String protectedText)

at Microsoft.Owin.Security.OAuth.OAuthBearerAuthenticationHandler.d__0.MoveNext()

The new certificate has been correctly imported on Sitecore app service, so I'm thinking perhaps I need to update some configuration value somewhere. However, the only configuration values I can seem to find are in App_Config\ConnectionStrings.config where some of the xconnect connection strings contain the thumbprint of the old certificate. Are there any configurations I need to update with the thumbprint of my new certificate or something else I am missing?

  • Possibly related and/or same issue. sitecore.stackexchange.com/questions/15711/… – Mark Cassidy Sep 24 at 7:54
  • @MarkCassidy I don't think it's the same issue. I already do what the solution in the linked issue suggests (using the correct grant_type and using the token as a bearer token in my requests from Postman. It used to work just fine. My issue started after attempting to use a new identity server certificate – csb Sep 24 at 9:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.