OpenID Connect in ASP.NET - at_hash validation [closed]
OpenID Connect in ASP.NET - at_hash validation [closed] I try to use OpenID Connect authentication against a well known IDP. I have tried from both ASP.NET and ASP.NET Core. Here is how I enable the OpenID Connect authentication in my ASP.NET Core 2.0 project: I get the same error in both projects: OpenIdConnectProtocolInvalidAtHashException: IDX21312: The 'at_hash' claim was not found in the 'id_token', but a 'access_token' was in the OpenIdConnectMessage, 'id_token' I see that the returned token does not contain the at_hash claim, but that should be ok since it is not mandatory. Is there a way to skip this validation? This question appears to be off-topic. The users who voted to close gave this specific reason: