Azure AD B2C's signature cannot be validated for tokens issued by Microsoft Graph API

Question

It's been three days that I have been trying to find a solution for the exception that I am getting for the following code to validate a Graph API token:

 var configManager = new ConfigurationManager<OpenIdConnectConfiguration>(
                            $"{_authenticationSettings.Authority}/.well-known/openid-configuration",
                            new OpenIdConnectConfigurationRetriever());
                        var config = await configManager.GetConfigurationAsync();
                        _validationParameters = new TokenValidationParameters
                        {
                            IssuerSigningKeys = config.SigningKeys,
                            ValidateAudience = true,
                            // Audience MUST be the app ID aka clientId
                            ValidAudience = _authenticationSettings.ClientId,
                            ValidateIssuer = true,
                            ValidIssuer = config.Issuer,
                            ValidateLifetime = true
                        };

var tokenHandler = new JwtSecurityTokenHandler();
var result = tokenHandler.ValidateToken(authHeader.Parameter, _validationParameters, out var jwtToken);

The exception happens when calling ValidateToken and reads as below:

Microsoft.IdentityModel.Tokens.SecurityTokenInvalidSignatureException: 'IDX10511: Signature validation failed. Keys tried: 'System.Text.StringBuilder'. kid: 'System.String'. Exceptions caught: 'System.Text.StringBuilder'. token: 'System.IdentityModel.Tokens.Jwt.JwtSecurityToken'.'

I am really running out of reasons why this should happen. Any ideas or suggestions to fix this problem?

The packages are:

    <PackageReference Include="System.IdentityModel.Tokens.Jwt" Version="6.8.0" />
    <PackageReference Include="Microsoft.IdentityModel.Protocols.OpenIdConnect" Version="6.8.0" />

Even this solution was not conclusive too.

Answer 1

Graph API tokens cannot and should not be validated and hence the signature validation fails. Please see this answer on GitHub.