HttpMethod property of DownstreamApiOptions fails to deserialize from appsettings.

[MZOLN]

Microsoft.Identity.Web Library

Microsoft.Identity.Web

Microsoft.Identity.Web version

2.11.1

Web app

Sign-in users

Web API

Protected web APIs call downstream web APIs

Token cache serialization

Not Applicable

Description

Deserialization of HttpMethod property of DownstreamApiOptions does not seem to work well.
Configuration system fails to deserialize System.Net.Http.HttpMethod from string, so my HttpMethod : "POST" always end up as a "GET".

Reproduction steps

For example, given settings like this:
"DownstreamApis":
"Api2Post": {
"BaseUrl": "https://fake.post.uri.microsoft.com/v1.0",
"RelativePath": "/me",
"Scopes": [ "https://fake.post.uri.microsoft.com/v1.0/me/user.read" ],
"HttpMethod": "POST",
"AcquireTokenOptions": {
"AuthenticationOptionsName": "S2SAuthentication"
}
}
}

deserializing with DI (that was my case):
services.Configure<Dictionary<string, DownstreamApiOptions>>(configuration.GetSection("DownstreamApis"));

Would result in still having the property value as a "GET"
Expected would be "POST"

Error message

No response

Id Web logs

No response

Relevant code snippets

Check the repro

Regression

No response

Expected behavior

HttpMethod property value deserialized as a provided value in appsettings.json.

[MZOLN]

Workarounds exist:

1. If not using DI read the configuration value directly
2. Use PostConfigure if using DI:

services.PostConfigure<Dictionary<string, DownstreamApiOptions>>(downstreamApiOptions =>
{
     foreach (var downstreamApiOption in downstreamApiOptions)
     {
          string httpMethodString = configuration[$"DownstreamApis:{downstreamApiOption.Key}:HttpMethod"] ?? "GET";
          downstreamApiOption.Value.HttpMethod = new HttpMethod(httpMethodString);
     }
});

[jmprieur]

Would that be that HttpMethod does not deserialize correctly in Json?
https://github.com/AzureAD/microsoft-identity-abstractions-for-dotnet/blob/cbdee8db6243c7c3cfbed824609701745110976c/src/Microsoft.Identity.Abstractions/DownstreamApi/AuthorizationHeaderProviderOptions.cs#L59