错误IDX10516: Signature validation failed. Unable to match key: kid发生在验证令牌签名的解码令牌中的Kid无效时。因此需要从openid提供程序加载密钥。

代码：

var openidConfiguration = new ConfigurationManager<OpenIdConnectConfiguration>(
                $"https://login.microsoftonline.com/{tenantid}/v2.0/.well-known/openid-configuration",
                new OpenIdConnectConfigurationRetriever(),
                new HttpDocumentRetriever());
            var config = await openidConfiguration.GetConfigurationAsync();

            var parameteres = new TokenValidationParameters()
            {
                RequireAudience = true,
                RequireExpirationTime = true,
                ValidateAudience = true,
                ValidateIssuer = true,
                ValidateLifetime = true,
                ValidAudiences = new[] { "<my client id or appId uri or resource identitifer>" },
                ValidIssuers = new[] { $"https://sts.windows.net/{tenantid}/" }, 
                IssuerSigningKeys = config.SigningKeys
            };

• AppId URI，您可以从门户查看：参数：

添加以下内容，以检查Startup.cs中ConfigureServices方法的更清晰描述性异常：IdentityModelEventSource.ShowPII = true

• 范例：*

public void ConfigureServices(IServiceCollection services)
        {
            
                     ...
            IdentityModelEventSource.ShowPII = true;
                       ...
             }

参考：Azure AD - Why can't I validate JWT token issued by Azure AD for my Web API? Getting "IDX10516: Signature validation failed" error - Stack Overflow