Update of System.IdentityModel.Tokens.Jwt causing breaking change in IdentityServer3 Client

Question

Hopefully an easy one to resolve.

Microsoft's System.IdentityModels.Tokens.Jwt package was updated yesterday on NuGet from 4.0.2.206211351 to v5.0. This is unfortunately causing a breaking change with some "standard" IdentityServer3 code. i.e. taken from their code samples so I imagine quite a few developers might see this issue over the coming days.

Original Code

using v4.0.2.xxxxxx version of the package. I have

using System.IdentityModel.Tokens; 

in the namespace.

then in the Configuration method begins as:

public void Configuration(IAppBuilder app)     {         AntiForgeryConfig.UniqueClaimTypeIdentifier = "sub";          JwtSecurityTokenHandler.InboundClaimTypeMap = new Dictionary<string, string>();          app.UseCookieAuthentication(new CookieAuthenticationOptions         {             AuthenticationType = "Cookies"         });          app.UseOpenIdConnectAuthentication(new OpenIdConnectAuthenticationOptions         { ... }; 

After Updating

After updating the confgiuration line:

JwtSecurityTokenHandler.InboundClaimTypeMap = new Dictionary<string, string>(); 

Is causing an issue.

The first thing being that the Class has, apparently, moved into the System.IdentityModel.Tokens.Jwt namespace, this isn't so bad to resolve.

However, I'm now getting an Object reference required for a non-static field error on the JwtSecurityTokenHandler.InboundClaimTypeMap.

Am I missing something here, another library that's required or is there something happening before the Startup.Configuration() is called that needs digging into?

Answer 1

When you go to the doctor and say "it always hurts when I do this" - the doctor will reply "then stopping doing this" ;)

v4 -> v5 is by definition a breaking change. Do you need v5?

That being said - a simple intellisense exploration would have brought up that they renamed InboundClaimTypeMap to DefaultInboundClaimTypeMap.

Be prepared for more breaking changes along the way.

Answer 2

Access token validation in OWIN is not compatible with system.identitymodel v5 - you need to downgrade to v4 - See issue here