SecurityTokenValidated回调是否使用Owin中间件自动验证令牌

我使用Azure Ad，并设置了我的Startup.Auth.cs文件如下我能够连接并使用Azure、Google、MS和Linked in成功地进行身份验证，并且我收到了一个id_token，但我希望能够验证我从Azure收到的这个令牌，但我不确定如何验证。引发的SecurityTokenValidated事件是否意味着令牌已经针对我定义的TokenValidationParameters进行了验证，并且我不需要验证令牌?如果是这样的话，我应该在TokenValidationParameters里面放些什么呢?

我收到的id_token不包含用于验证

app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);
            app.UseCookieAuthentication(new CookieAuthenticationOptions
                {
                    SlidingExpiration = true,
                    LoginPath = new PathString("/"),
                    CookieSecure = CookieSecureOption.Always,

                });
            var options = new OpenIdConnectAuthenticationOptions
            {
                Authority = "https://login.windows.net/common",
                ClientId = clientId,
                RedirectUri = redirectUri,
                PostLogoutRedirectUri = postLogoutRedirectUri,
                Notifications = new OpenIdConnectAuthenticationNotifications
                {
                    AuthenticationFailed = AuthenticationFailed,
                    RedirectToIdentityProvider = OnRedirectToIdentityProvider,
                    SecurityTokenReceived = OnSecurityTokenReceived,
                    AuthorizationCodeReceived = OnAuthorizationCodeReceived,
                    SecurityTokenValidated = OnSecurityTokenValidated,
                    MessageReceived = OnMessageReceived
                },
                Scope = "openid",
                ResponseType = "id_token",
                Description = new AuthenticationDescription
                {
                    AuthenticationType = "OpenIdConnect",
                                        },
                ConfigurationManager = new PolicyConfigurationManager(
                    string.Format(CultureInfo.InvariantCulture, aadInstance, tenant, "/v2.0", OidcMetadataSuffix),
                    new[] { SisuGoogle, SisuLinkedIn, SisuMicrosoft, SisuLocal, ResetPasswordLocalPolicyId }),

                TokenValidationParameters = new TokenValidationParameters
                {
                    ValidAudiences = new string[]
                    {
                     "http://localhost:44330/",

                    },
                    IssuerSigningKey = GetSecurityKey(),
                    // If you don't add this, you get IDX10205
                    //ValidateIssuer = false,
                },
            };
            app.UseOpenIdConnectAuthentication(options);

 private SecurityKey GetSecurityKey()
        {
            var securityKey = "secure key";
            var signingKey = new InMemorySymmetricSecurityKey(Encoding.UTF8.GetBytes(securityKey));
            var signingCredentials = new SigningCredentials(signingKey, SecurityAlgorithms.RsaSha256Signature,SecurityAlgorithms.Sha256Digest);
            return signingCredentials.SigningKey;
        }

    private Task OnSecurityTokenValidated(SecurityTokenValidatedNotification<OpenIdConnectMessage, OpenIdConnectAuthenticationOptions> arg)
            {

//do I need to validate the token here or has it already been validated??
//if I have to validate it then how do I? I've tried the following but does not work
                var tokenValidationParameters = new TokenValidationParameters
                {
                    IssuerSigningKey = GetSecurityKey()
                };
                SecurityToken validatedToken;
                var jwtHandler = new JwtSecurityTokenHandler();

    //crashes at this point
                jwtHandler.ValidateToken(arg.ProtocolMessage.IdToken, tokenValidationParameters, out validatedToken);

                return Task.FromResult(0);
            }