Error loading System.IdentityModel.Tokens.Jwt dll in WebAPI2 project

Question

I am getting the below error in WebApi2 project:

Could not load file or assembly 'System.IdentityModel.Tokens.Jwt, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35' or one of its dependencies. The located assembly's manifest definition does not match the assembly reference. (Exception from HRESULT: 0x80131040)

I have these set of related NuGet packages installed, along with a bunch of others:

"Microsoft.IdentityModel.Protocol.Extensions" version="1.0.2.206221351" targetFramework="net45"

"Microsoft.Owin" version="3.0.1" targetFramework="net45"

"Microsoft.Owin.Host.SystemWeb" version="3.0.1" targetFramework="net45"

"Microsoft.Owin.Security" version="3.0.1" targetFramework="net45"

"Microsoft.Owin.Security.ActiveDirectory" version="3.0.1" targetFramework="net45"

"Microsoft.Owin.Security.Jwt" version="3.0.1" targetFramework="net45"

"Microsoft.Owin.Security.OAuth" version="3.0.1" targetFramework="net45"

"System.IdentityModel.Tokens.Jwt" version="4.0.2.206221351" targetFramework="net45"

Btw, I have the below binding redirect in my web.config too but it still it tries to load the 4.0 version.

  <dependentAssembly>
    <assemblyIdentity name="System.IdentityModel.Tokens.Jwt" publicKeyToken="31bf3856ad364e35" culture="neutral" />
    <bindingRedirect oldVersion="0.0.0.0-4.0.20622.1351" newVersion="4.0.20622.1351" />
  </dependentAssembly>

Any help in troubleshooting would be highly appreciated.

Answer 1

I ran into the exactly same troubles.

The reason is, that the latest versions of System.IdentityModel.Tokens.Jwt and System.IdentityModel.Tokens has some NuGet versions mishmash and they're not compatible with startup UseJwtBearerAuthentication method which requires System.IdentityModel v. 4.0.0.0.

If you're using nuget, you can be easily confused, because:

System.IdentityModel.Tokens is available in nuget just as pre-release 5.0.0.112 (nowdays)

System.IdentityModel.Tokens.Jwt latest version in nuget is available as pre-release version 5.0.0.112 OR 4.0.2.206221351 stable.

BUT, when you set JWT authentication in WebAPI

app.UseJwtBearerAuthentication(new JwtOptions());

System.IdentityModel version 4.0.0.0 is required.

The working solution for me is:

1) uninstall previously installed System.IdentityModel.Tokens nuget package

Uninstall-Package System.IdentityModel.Tokens

2) uninstall latest System.IdentityModel.Tokens.Jwt nuget package

Uninstall-Package System.IdentityModel.Tokens.Jwt

3) install System.IdentityModel.Tokens.Jwt version 4.0.2.206221351 (latest stable)

Install-Package System.IdentityModel.Tokens.Jwt -Version 4.0.2.206221351

4) add reference (not nuget!) to .NET framework assembly System.IdentityModel. Right click on project -> References -> Add reference -> Assemblies -> Framework -> select System.IdentityModel 4.0.0.0

Some steps may differ depending on what have you already installed/uninstalled.

Answer 2

In my case adding binding redirect helps.

I have a windows service application, which consumes Microsoft.Owin.Security.Jwt (3.0.1) and System.IdentityModel.Tokens.Jwt (4.0.20622.1351); As I can see, Microsoft.Owin.Security.Jwt (3.0.1) has reference to the System.IdentityModel.Tokens.Jwt (4.0.0) [katanaproject]:

<Reference Include="System.IdentityModel.Tokens.Jwt, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL">
  <SpecificVersion>False</SpecificVersion>
  <HintPath>..\..\packages\System.IdentityModel.Tokens.Jwt.4.0.0\lib\net45\System.IdentityModel.Tokens.Jwt.dll</HintPath>
</Reference>

The exception mentioned above has ocured exactly when the call was made:

app.UseJwtBearerAuthentication(new CustomJwtOptions());

So I can conclude that package Microsoft.Owin.Security.Jwt (3.0.1) tries to load System.IdentityModel.Tokens.Jwt (4.0.0)

EDIT

We have simple .net app, which is distributed with app.exe.config file. Modifying the file helps to solve the problem mentioned:

<?xml version="1.0" encoding="utf-8"?>
<configuration>
<!-- ... -->
<runtime>
    <!-- ... -->
    <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">
        <!-- ... -->
        <dependentAssembly>
            <assemblyIdentity name="System.IdentityModel.Tokens.Jwt" 
                              publicKeyToken="31bf3856ad364e35" 
                              culture="neutral" />
            <bindingRedirect oldVersion="0.0.0.0-4.0.20622.1351" 
                             newVersion="4.0.20622.1351" />
        </dependentAssembly>
        <!-- ... -->
    </assemblyBinding>
    <!-- ... -->
</runtime>
<!-- ... -->
</configuration>