Signature verification in Azure API Management with openid-config
I'm going through the documentation - https://zcusa.951200.xyz/en-us/azure/api-management/validate-jwt-policy to set up JWT validation for my APIs in Azure API Management.
What exactly are the steps executed when openid-config
is included in the API Management Policy and an OpenID compliant configuration endpoint URL is specified? Is signature verification performed by default when openid-config
is included?
Specifically, I want to understand when there would be a need to specify issuer-signing-keys
and whether it is required if my OpenID compliant configuration endpoint URL provides the JWKS URI.