Bearer was not authenticated: Signature validation failed

Question

I am using Identity Server 4 to protect my APIs (Implicit Flow Mode) which are accessed by angular application. Every thing is working fine, however at specific period the access token suddenly became invalid even before its expiry.

Configuration:

Here is the Identity Server Startup file:

 var identityBuilder = services.AddIdentityServer().AddInMemoryStores().SetTemporarySigningCredential();

 identityBuilder.AddInMemoryScopes(identitySrvConfig.GetScopes());
 identityBuilder.AddInMemoryClients(identitySrvConfig.GetClients());

Protecting the APIs:

   app.UseIdentityServerAuthentication(new IdentityServerAuthenticationOptions
        {
            Authority = identityOptions.Authority,
            ScopeName = "userProfile_api",


            RequireHttpsMetadata = false
        });

Investigation:

The issue was the bearer was not authenticated

Bearer was not authenticated. Failure message: IDX10501: Signature validation failed. Unable to match 'kid': 'e4f3534e5afd70ba74c245fe2e39c724', token

After some investigation, it appears that identity server is generating a new key which was causing the signature validation to fail.

In the log, I can see when the two warning events at end happening, then I see "Repository contains no viable default key" and "a new key should be added to the ring"

Questions

Why would there no be a key at anytime when the key lifetime is almost 3 months even I am using temporary signing (SetTemporarySigningCredential) and I am not restarting the server?

Creating key {a2fffa4a-345b-4f3b-bae7-454d567a1aee} with creation date 2017-03-03 19:15:28Z, activation date 2017-03-03 19:15:28Z, and expiration date 2017-06-01 19:15:28Z. 

How can I solve this issue?

Answer 1

Creating a self signing certificate and removing the temporary signing on identity server fixed the issue.

var signingCertificate = new X509Certificate2("ReplaceByCertificatePath, "ReplaceByPasswordCertificate");
var identityBuilder = services.AddIdentityServer().AddInMemoryStores().SetSigningCredential(signingCertificate);

identityBuilder.AddInMemoryScopes(IdentitySrvConfig.GetScopes());
identityBuilder.AddInMemoryClients(IdentitySrvConfig.GetClients());