Validating security tokens

namespace Example
{
    /// <summary>
    /// SuperOffice jwt token validator
    /// </summary>
    internal class SampleValidator
    {
        public Microsoft.IdentityModel.Tokens.TokenValidationResult ValidateSuperOfficeToken(string token)
        {
            var securityTokenHandler =
                new Microsoft.IdentityModel.JsonWebTokens.JsonWebTokenHandler();

            string issuer;
            string audience;

            // extract the ValidAudience claim value (database serial number).
            var securityToken = securityTokenHandler.ReadJsonWebToken(token);

            // get the audience from the token
            if (!securityToken.TryGetPayloadValue<string>("aud", out audience))
            {
                throw new Microsoft.IdentityModel.Tokens.SecurityTokenException(
                    "Unable to read ValidAudience from token.");
            }

            // get the issuer from the token
            if (!securityToken.TryGetPayloadValue<string>("iss", out issuer))
            {
                throw new Microsoft.IdentityModel.Tokens.SecurityTokenException(
                    "Unable to read ValidAudience from token.");
            }

            var validationParameters =
                new Microsoft.IdentityModel.Tokens.TokenValidationParameters();
            validationParameters.ValidAudience = audience;
            validationParameters.ValidIssuer = issuer;

            // Option #1 *************************************************************
            // use the local SuperOffice public certificate (SuperOfficeFederatedLogin)

            var certPath = Path.Combine("Certificates", "SuperOfficeFederatedLogin.crt");
            var x509Cert = new System.Security.Cryptography.X509Certificates.X509Certificate2(certPath);
            validationParameters.IssuerSigningKey = new Microsoft.IdentityModel.Tokens.X509SecurityKey(x509Cert);

            // Option #2 *************************************************************
            // use the OpenID Connect Jwks endpoint to get the public certificate.

            validationParameters.IssuerSigningKeys = GetJsonWebKeys("sod");

            var result = securityTokenHandler.ValidateToken(token, validationParameters);

            if (result.Exception != null || !result.IsValid)
            {
                throw new Microsoft.IdentityModel.Tokens.SecurityTokenValidationException(
                    "Failed to validate the token", result.Exception);
            }
            return result;
        }

        private IList<JsonWebKey> GetJsonWebKeys(string environment)
        {
            // example only... needs exception handing...!!!
            var client = new HttpClient();
            var jwksContent = client.GetStringAsync($"https://{environment}.superoffice.com/login/.well-known/jwks");
            return JsonWebKeySet.Create(jwksContent.Result).Keys;
        }
    }
}