How to manually generate an OIDC token signed with a public key? - asp.net-core-webapi

Question

In my ASP .NET Core Web API, I'm manually generating a token for mocking purposes. However, it appears the token generator assumes the signature has a private key, while that's not the case. The key is public, retrieved from a JWKS. I don't know how to make this clear to the token generator. Can anyone help me?
This is my code:
private async Task<string> GenerateSecurityToken(string _expDate, string _issuer, string _audience, string _wellKnownEndpoint)
{
var configurationManager = new ConfigurationManager<OpenIdConnectConfiguration>(_wellKnownEndpoint, new OpenIdConnectConfigurationRetriever());
OpenIdConnectConfiguration openIdConfig = await configurationManager.GetConfigurationAsync(CancellationToken.None);
SecurityKey securityKey = openIdConfig.SigningKeys.Last();
var tokenDescriptor = new SecurityTokenDescriptor()
{
Subject = new ClaimsIdentity(),
Expires = DateTime.UtcNow.AddMinutes(double.Parse(_expDate)),
Audience = _audience,
Issuer = _issuer,
SigningCredentials = new SigningCredentials(securityKey, SecurityAlgorithms.RsaSha256Signature)
};
var tokenHandler = new JwtSecurityTokenHandler();
SecurityToken token = tokenHandler.CreateToken(tokenDescriptor); // Raises exception
return tokenHandler.WriteToken(token);
}
And this is the raised exception:
System.InvalidOperationException: IDX10638: Cannot create the SignatureProvider, 'key.HasPrivateKey' is false, cannot create signatures.

Answer 1

The identity provider use private key to encrypt token , and when validating token , you can get public key cryptography to sign tokens and verify that they're valid. So you can use a traditional way to get access token from identity provider using delegating flows , rather than use public key to issue access token manually .