question

Hello,

I'm trying to integrate Azure B2C with an external openID identity Provider called ItsMe : https://oidc.e2e.itsme.services/clientsecret-oidc/csapi/v0.1/.well-known/openid-configuration
I followed the steps described here : https://docs.microsoft.com/en-us/azure/active-directory-b2c/partner-itsme
Our external provider is configured with the following redirect-url : https://[tenantname].b2clogin.com/[tenantname].onmicrosoft.com/oauth2/authresp

But when I either runthe User Flows or my Custom Flow, I always receive the same error :
AADB2C90239: The provided token failed signature validation. Please provide another token and try again.

I added application insight to try to get more information, and the error occurs in step 2 with :

 "Kind": "HandlerResult",
 "Content": {
   "Result": true,
   "RecorderRecord": {
     "Values": [
       {
         "Key": "SendErrorTechnicalProfile",
         "Value": "OpenIdConnectProtocolProvider"
       },
       {
         "Key": "Exception",
         "Value": {
           "Kind": "Handled",
           "HResult": "80131500",
           "Message": "The provided token failed signature validation. Please provide another token and try again.",
           "Data": {
             "IsPolicySpecificError": false
           },
           "Exception": {
             "Kind": "Handled",
             "HResult": "80131501",
             "Data": {}
           }
         }
       }
     ]
   },

The step 2 being :

     <OrchestrationStep Order="2" Type="ClaimsExchange">
       <Preconditions>
         <Precondition Type="ClaimsExist" ExecuteActionsIf="true">
           <Value>objectId</Value>
           <Action>SkipThisOrchestrationStep</Action>
         </Precondition>
       </Preconditions>
       <ClaimsExchanges>
         <ClaimsExchange Id="SignUpWithLogonEmailExchange" TechnicalProfileReferenceId="LocalAccountSignUpWithLogonEmail" />
         <ClaimsExchange Id="ItsmeExchange" TechnicalProfileReferenceId="Itsme-OIDC" />
         <ClaimsExchange Id="ForgotPasswordExchange" TechnicalProfileReferenceId="ForgotPassword" />
         <ClaimsExchange Id="TrackSignInRequest" TechnicalProfileReferenceId="AppInsights-SignInRequest" />
       </ClaimsExchanges>
     </OrchestrationStep>

My Technical profile looks like this :

 <ClaimsProvider>
   <Domain>itsme.be</Domain>
   <DisplayName>itsme</DisplayName>
   <TechnicalProfiles>
     <TechnicalProfile Id="Itsme-OIDC">
       <DisplayName>itsme</DisplayName>
       <Protocol Name="OpenIdConnect" />
       <Metadata>
         <Item Key="ProviderName">itsme</Item>
         <Item Key="METADATA">https://oidc.e2e.itsme.services/clientsecret-oidc/csapi/v0.1/.well-known/openid-configuration</Item>
         <Item Key="authorization_endpoint">https://oidc.e2e.itsme.services/clientsecret-oidc/csapi/v0.1/connect/authorize</Item>
         <Item Key="scope">openid service:TEST_LOGIN</Item>
         <Item Key="response_types">code</Item>
         <Item Key="response_mode">form_post</Item>
         <Item Key="token_endpoint_auth_method">client_secret_post</Item>        
         <Item Key="HttpBinding">POST</Item>         
         <Item Key="UsePolicyInRedirectUri">false</Item>
         <Item Key="client_id">*MyClientID*</Item>
       </Metadata>
       <CryptographicKeys>
         <Key Id="client_secret" StorageReferenceId="B2C_1A_ItsmeSecret" />
       </CryptographicKeys> 
       <OutputClaims>
         <OutputClaim ClaimTypeReferenceId="identityProvider" DefaultValue="itsme" />
         <OutputClaim ClaimTypeReferenceId="authenticationSource" DefaultValue="socialIdpAuthentication" />
         <OutputClaim ClaimTypeReferenceId="issuerUserId" PartnerClaimType="sub" />
         <OutputClaim ClaimTypeReferenceId="displayName" PartnerClaimType="name" />
         <OutputClaim ClaimTypeReferenceId="givenName" PartnerClaimType="given_name" />
         <OutputClaim ClaimTypeReferenceId="surname" PartnerClaimType="family_name" />
         <OutputClaim ClaimTypeReferenceId="email" PartnerClaimType="email" />            
       </OutputClaims>
       <OutputClaimsTransformations>
         <OutputClaimsTransformation ReferenceId="CreateRandomUPNUserName" />
         <OutputClaimsTransformation ReferenceId="CreateUserPrincipalName" />
         <OutputClaimsTransformation ReferenceId="CreateAlternativeSecurityId" />
         <OutputClaimsTransformation ReferenceId="CreateSubjectClaimFromAlternativeSecurityId" />
       </OutputClaimsTransformations>
       <UseTechnicalProfileForSessionManagement ReferenceId="SM-SocialLogin" />       
     </TechnicalProfile>
   </TechnicalProfiles>
 </ClaimsProvider>

I'm currently out of ideas... I was hoping to see the actual reponse from the external provider using application insight, but I couldn't find anything usuful...
Any help would be greatly appreciated...
Thanks !

Briac