.NET 8升级后JWT Bearer Token授权失效问题求助

不少开发者升级至.NET 8时遇到JWT认证相关问题，我排查了现有解决方案但均不适用，也未找到相同问题案例。本人对JWT及认证相关知识了解有限，以下是具体问题详情：

.NET 7中正常运行的代码 #

options.TokenValidationParameters = new TokenValidationParameters
{
    ValidateIssuer = true,
    ValidateIssuerSigningKey = true,
    ValidateAudience = true,
    ValidateLifetime = true,
    ClockSkew = TimeSpan.Zero
};

options.Authority = KeyCloakOptions.Authority;
options.MetadataAddress = $"{options.Authority}/.well-known/openid-configuration";
options.RequireHttpsMetadata = false;
options.RefreshOnIssuerKeyNotFound = true;
options.Audience = KeycloakOptions.AudienceInvoice;
options.Events = new JwtBearerEvents
{
    OnAuthenticationFailed = context =>
    {
        _logger.LogDebug("Authentication failed: " + context);
        return Task.CompletedTask;
    },
    OnTokenValidated = context =>
    {
        _logger.LogDebug("JWT Bearer Token Validated.");
        return Task.CompletedTask;
    }
};

.NET 8中的报错及尝试过程 #

将上述代码迁移至.NET 8后，首先出现颁发者验证错误：

IDX10204: Unable to validate issuer. validationParameters.ValidIssuer is null or whitespace AND validationParameters.ValidIssuers is null or empty.

添加ValidIssuer到TokenValidationParameters后，该错误解决：

options.TokenValidationParameters = new TokenValidationParameters
{
    ValidateIssuer = true,
    ValidateIssuerSigningKey = true,
    ValidateAudience = true,
    ValidateLifetime = true,
    ClockSkew = TimeSpan.Zero,
    ValidIssuer = KeyCloakOptions.Authority
};

但随即出现受众验证错误：

IDX10208: Unable to validate audience. validationParameters.ValidAudience is null or whitespace and validationParameters.ValidAudiences is null.

继续添加ValidAudience到TokenValidationParameters后，受众错误解决：

options.TokenValidationParameters = new TokenValidationParameters
{
    ValidateIssuer = true,
    ValidateIssuerSigningKey = true,
    ValidateAudience = true,
    ValidateLifetime = true,
    ClockSkew = TimeSpan.Zero,
    ValidIssuer = KeyCloakOptions.Authority,
    ValidAudience = KeycloakOptions.AudienceInvoice
};

此时又出现签名密钥相关错误，无法继续解决。

核心疑问与需求 #

• 为何.NET 8中需要在TokenValidationParameters中显式指定颁发者、受众及密钥，而.NET 7中仅通过options的Authority、Audience等配置即可正常运行？看起来options.MetadataAddress等配置在.NET 8中被忽略了。
• 需要修改或添加哪些配置，才能让原.NET 7的代码在.NET 8中正常运行？

内容的提问来源于stack exchange，提问作者Eric