React + .NET 集成Entra ID认证时，后端验证AccessToken出现签名无效（IDX10511）错误的求助

我现在遇到了一个Entra ID认证的棘手问题，想求助大家帮忙排查下：

我在React前端用Entra ID做用户授权，这部分功能是正常的。现在需要把获取到的accessToken通过Authorization头传给.NET后端，前端传参的逻辑是通的，但后端验证token的时候一直返回401 Unauthorized，响应头里的WWW-Authenticate信息如下：

WWW-Authenticate: Bearer error="invalid_token", error_description="The signature is invalid

后端的错误日志如下：

info: Microsoft.IdentityModel.LoggingExtensions.IdentityLoggerAdapter[0]
      IDX10243: Reading issuer signing keys from validation parameters.
info: Microsoft.IdentityModel.LoggingExtensions.IdentityLoggerAdapter[0]
      IDX10265: Reading issuer signing keys from configuration.
info: Microsoft.IdentityModel.LoggingExtensions.IdentityLoggerAdapter[0]
      IDX10243: Reading issuer signing keys from validation parameters.
fail: Microsoft.IdentityModel.LoggingExtensions.IdentityLoggerAdapter[0]
      IDX10511: Signature validation failed. Keys tried: 'Microsoft.IdentityModel.Tokens.X509SecurityKey, KeyId: '3PaK4EfyBNQu3CtjYsa3YmhQ5E0', InternalId: '3PaK4EfyBNQu3CtjYsa3YmhQ5E0'. , KeyId: 3PaK4EfyBNQu3CtjYsa3YmhQ5E0
      '.
Number of keys in TokenValidationParameters: '0'.
Number of keys in Configuration: '8'.
Matched key was in 'Configuration'.
kid: '3PaK4EfyBNQu3CtjYsa3YmhQ5E0'.
Exceptions caught:
 '[PII of type 'System.String' is hidden. For more details, see https://aka.ms/IdentityModel/PII.]'.
token: '[PII of type 'Microsoft.IdentityModel.JsonWebTokens.JsonWebToken' is hidden. For more details, see https://aka.ms/IdentityModel/PII.]'. See https://aka.ms/IDX10511 for details.

我已经尝试调整了后端的认证配置，下面是试过的几种写法（注释掉的都是尝试过但未解决问题的，当前生效的是未注释的那段）：

/*builder.Services.AddMicrosoftIdentityWebApiAuthentication(builder.Configuration);*/

/*builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddMicrosoftIdentityWebApi(builder.Configuration, "AzureAd");
*/

builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
        .AddMicrosoftIdentityWebApi(builder.Configuration.GetSection("AzureAd"))
        .EnableTokenAcquisitionToCallDownstreamApi()
        .AddInMemoryTokenCaches();

/*builder.Services.AddAuthorization(config =>
{
    config.AddPolicy("AuthZPolicy", policyBuilder =>
        policyBuilder.Requirements.Add(new ScopeAuthorizationRequirement() { RequiredScopesConfigurationKey = $"AzureAd:Scopes" }));
});*/

前端这边是用axios拦截器自动给请求添加token的，代码如下：

axios.interceptors.request.use(async config => {
    const authToken = await instance.acquireTokenSilent({
      scopes: ['openid', 'profile', 'email']
    });
    console.log(authToken.accessToken);
    const accessToken = authToken.accessToken;
    config.headers.Authorization = `Bearer ${accessToken}`;
    return config;
  });

我几乎把能试的配置都调整过了，但这个签名无效的错误就是一直存在，有没有遇到过类似问题的朋友能给点排查思路？

备注：内容来源于stack exchange，提问作者Pascal