如何在c# webapi中使用IdentityModel.OidcClient验证和验证支持openid连接的active directory服务生成的令牌？

using IdentityModel.OidcClient;
using IdentityModel.OidcClient.Infrastructure;
using Microsoft.AspNetCore.Mvc;
using System.Threading.Tasks;

namespace YourWebApi.Controllers
{
    [ApiController]
    [Route("[controller]")]
    public class AuthController : ControllerBase
    {
        private readonly OidcClient _oidcClient;

        public AuthController()
        {
            var options = new OidcClientOptions
            {
                Authority = "https://your-active-directory-url",
                ClientId = "your-client-id",
                ClientSecret = "your-client-secret",
                RedirectUri = "https://your-callback-url",
                Scope = "openid profile email",
                FilterClaims = false
            };

            _oidcClient = new OidcClient(options);
        }

        [HttpGet("Login")]
        public async Task<IActionResult> Login()
        {
            var result = await _oidcClient.LoginAsync(new LoginRequest());

            if (result.IsError)
            {
                // 处理登录错误
                return BadRequest(result.Error);
            }

            // 验证令牌
            var tokenValidationParameters = new TokenValidationParameters
            {
                ValidIssuer = "https://your-active-directory-url",
                ValidAudience = "your-client-id",
                IssuerSigningKeys = new List<SecurityKey>()
            };

            var handler = new JwtSecurityTokenHandler();
            var user = handler.ValidateToken(result.AccessToken, tokenValidationParameters, out _);

            // 提取用户信息并进行业务逻辑处理
            var userId = user.FindFirst("sub")?.Value;
            var userName = user.FindFirst("name")?.Value;

            // 返回登录成功的响应
            return Ok(new { UserId = userId, UserName = userName });
        }
    }
}