Json token issuer Issuer is marked as self issuer but is asserting a different NameId. Throwing. IssuerName:

Hello all,   We try to create a Subsite via SP 2013 Workflow with REST-API Call “App-Step include” and get the Error unauthorized.

Workflow App-only Permission are created.

Workflows without App-Step are still running. Error in ULS Log: Json token issuer Issuer is marked as self issuer but is asserting a different NameId. Throwing. IssuerName: '00000005-0000-0000-c000-000000000000@35e23ab5-4b1b****************e23ab5-4b1b-aa73', TokenIssuer: '00000005-0000-0000-c000-000000000000@35e2********************73'    

We tried different Accounts running the Workflow, including the Farm Admin Account, but all Accounts get the same Error (unauthorized)... Workflow Health Screen:

Setup Informations: Sharepoint SE (Build: 16.0.16731.20402);

SharePoint Single Server Farm;

Workflow Server on a separate Host (Domain Member);

Registered via New-SPTrustedSecurityTokenIssuer (https with cert from AD-CA);

UPS are Running and work E-Mail field are filled with content;

I'm not sure that the Json token issuer Error in the ULS Log are the "issue" and how i can fix it.

Thanks for any ideas about this. Greetings Olli

Update: is it evtl. necessary that the SPTrustedIdentityProvider are configured?