Configure Custom Identity provider

I'm pretty sure I had this working at one time, but now I cannot get the custom Identity Provider to work. I have [IdentityServer](https://github.com/IdentityServer/IdentityServer3) running in an app service. This is the token it generates:

```json
{
"nbf": 1718369848,
"exp": 1718373448,
"iss": "https://[redacted].azurewebsites.net",
"aud": "api-m2m",
"client_id": "3f53a72a-32ab-4e40-9ae5-08dc8c4d08cd",
"appid": "sandbox-ls",
"roles": "smartUser",
"scp": "system/*.read",
"jti": "565DA07050D5AB8058057609519D4BE5",
"iat": 1718369848,
"scope": "system/*.read"
}
```
I checked the fields a hundred times:
- Authority Field: https://[redacted].azurewebsites.net
- Client ID: sandbox-ls (the `appid` claim)
- Audience: api-m2m (the `aud` claim)

And I get the following answer from the FHIR service:
```
HTTP/1.1 403 Forbidden

{
"resourceType": "OperationOutcome",
"id": "28294463e393a1ffdcfc1c203d370539",
"meta": {
"lastUpdated": "2024-06-14T13:11:01.8220825+00:00"
},
"issue": [
{
"severity": "error",
"code": "forbidden",
"diagnostics": "Authorization failed."
}
]
}
```
Which means that my settings are correct, otherwise I would have gotten a `401`.

Why am I getting `Forbidden`? How can I troubleshoot this?

Start by reviewing the custom Identity Provider configuration against the supplied IdentityServer token claims, especially the authority, client ID, audience, and authorization-related claims. Reproduce the FHIR request and determine why the service returns 403 rather than 401; done means documenting the verified cause and troubleshooting or configuration steps.

Written by the indexing model from the issue text.