[Bug] ValidateIssuer does not work on WebApp and WebApi mix

[jc4gh]

Which version of Microsoft Identity Web are you using?
Note that to get help, you need to run the latest version.
Microsoft Identity Web 1.8.2

Where is the issue?

• Web app
  • Sign-in users
  • Sign-in users and call web APIs
• Web API
  • Protected web APIs (validating tokens)
  • Protected web APIs (validating scopes)
  • Protected web APIs call downstream web APIs
• Token cache serialization
  • In-memory caches
  • Session caches
  • Distributed caches
• Other (please describe)

Is this a new or an existing app?
a. The app is in production and I have upgraded to a new version of Microsoft Identity Web.

Repro

services.AddAuthentication(OpenIdConnectDefaults.AuthenticationScheme)
                .AddMicrosoftIdentityWebApp(this.Configuration.GetSection("AzureAd"));

    services.AddAuthentication()
        .AddMicrosoftIdentityWebApi(this.Configuration.GetSection("AzureAd"), JwtBearerDefaults.AuthenticationScheme)
        .EnableTokenAcquisitionToCallDownstreamApi()
        .AddDownstreamWebApi("API", this.Configuration.GetSection("API"))
        .AddInMemoryTokenCaches();

  "AzureAd": {
    "Instance": "https://login.microsoftonline.com/",
    "Domain": "domain.onmicrosoft.com",
    "TenantId": "organizations",
    "CallbackPath": "/signin-oidc",
    "EnablePiiLogging": true,
    "TokenValidationParameters": {
      "ValidateIssuer": true,
      "ValidIssuers": [ "https://sts.windows.net/{tenantid1}/", "https://sts.windows.net/{tenantid2}/" ]
    }  

Expected behavior
Validates issuer for JwtBearer.

Actual behavior
No validation happens.

Possible solution

Additional context / logs / screenshots
JwtBearerOptions seem to be get set correctly from Configuration.Bind. I've also tried

services.Configure<JwtBearerOptions>(JwtBearerDefaults.AuthenticationScheme, options =>
{
  var existingOnTokenValidatedHandler = options.Events.OnTokenValidated;
  options.Events.OnTokenValidated = async context =>
  {
       await existingOnTokenValidatedHandler(context);
      // Your code to add extra configuration that will be executed after the current event implementation.
      options.TokenValidationParameters.ValidIssuers = new[] { /* list of valid issuers */ };
      options.TokenValidationParameters.ValidAudiences = new[] { /* list of valid audiences */};
  };
});

but it did not make a difference.

For WebApp + WebApi mix, I used this

[jmprieur]

There is a work item in progress to make this scenario (multiple schemes) work correctly. Unfortunately we got higher priority work recently but we should get back to this soon
Duplicate of #955

[jennyf19]

Included in 1.11.0 release and documentation here.