Yes, you can use the `validate-jwt` policy to validate tokens from multiple issuers in Azure APIM. However, there are some considerations to keep in mind:
1. Specifying Multiple Issuers: You can explicitly list multiple issuers in the `validate-jwt` policy. For example, you can include multiple `` elements within the `` section of your policy[1][5].
2. OpenID Configuration: If you specify an OpenID Connect configuration URL (`openid-config`), Azure APIM will use it to obtain the issuers and signing keys. However, if you want to explicitly specify additional issuers beyond those in the OpenID configuration, you should remove the `openid-config` element to ensure that your explicitly listed issuers are evaluated correctly[5].
3. Combining Issuers: When you specify multiple issuers explicitly and use an OpenID configuration, the issuers from both sources will be combined. This allows you to validate tokens from multiple issuers, including those not listed in the OpenID configuration[1].
4. Validation Logic: Ensure that your validation logic is correctly configured to handle multiple issuers. This might involve custom conditions or additional checks if needed[1][3].
In summary, while the `validate-jwt` policy supports validating tokens from multiple issuers, careful configuration is necessary to ensure that all desired issuers are properly evaluated.
Citations:
[1] https://stackoverflow.com/questions/63700252/validate-multiple-issuers-in-azure-apim-policy
[2] https://docs.mulesoft.com/gateway/latest/policies-included-jwt-validation
[3] https://codeomelet.com/posts/creating-validate-jwt-policy-in-azure-apim
[4] https://auth0.com/blog/how-to-validate-jwt-dotnet/
[5] https://learn.microsoft.com/en-us/answers/questions/569321/azure-apim-validate-jwt-policy-is-not-evaluating-t
[6] https://stackoverflow.com/questions/56017333/how-to-validate-jwt-token-from-different-issuer
[7] https://docs.solo.io/gloo-mesh-gateway/main/security/jwt/jwt-multiple-policies/
[8] https://www.ibm.com/docs/en/api-connect/10.0.x?topic=policies-validate-jwt
[9] https://discuss.istio.io/t/multiple-jwt-and-validating/16362