The fully qualified catch recommended by Derek didn't work for me. I believe the namespace for the exception is the same in both 'Microsoft.IdentityModel.Tokens, Version=5.2.4.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35' and 'Microsoft.IdentityModel, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35'. I got around it by--instead of backing WAY off and using a base Exception class like Derek suggested--using the class the exception at Microsoft.IdentityModel.Tokens.SecurityTokenExpiredException
inherits from: Microsoft.IdentityModel.Tokens.SecurityTokenValidationException
. Thus, my solution changed the catch block to:
catch (Microsoft.IdentityModel.Tokens.SecurityTokenValidationException)