System.IdentityModel: status, governance and API convergence

[kevinchalet]

Disclaimer: I'm well aware that the IdentityModel stack is managed by the Azure AD team and not by the FX team and that related tickets should be opened elsewhere. Unfortunately, it seems to be in a pretty bad state these days: the activity is terribly low for such an important stack, critical bugs are not fixed and there's literally no plan for API convergence. By opening a ticket here, I hope this ticket will draw more attention from MSFT.

So here are my questions:

• Is there any plan to realign IdentityModel for .NET Core with its .NET Desktop counterpart as part of API convergence/.NET Standard 2.0? The .NET Core version lacks many important APIs compared to the .NET Desktop bits (it's basically a simple port of the JWT handler plus a bunch of other types that were needed for things like the OpenID Connect middleware for ASP.NET Core to work correctly).
• Can you share an approximative timeline for fixing the critical bugs? A few annoying bugs were reported in July/August and are still in need of an urgent fix (e.g this bug).
• Will IdentityModel for .NET Desktop get updates in the future? I'm mainly interested in knowing if it will ever support RSACng and ECDSA.

It's quite obvious that the Azure AD team doesn't currently have the human resources needed to manage such an important stack. Maybe it would be worth considering assigning new developers to IdentityModel or transferring its ownership to another team? It seems that the WCF team is currently relying on private IdentityModel bits to make WCF work, maybe they would be interested in collaborating to IM?

/cc @vibronet @polita @brentschmaltz

[danmoseley]

@terrajobst

[blowdart]

Addressed in

AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet#480 (comment)
AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet#477
AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet#476 (comment)

[kevinchalet]

@blowdart admit it, you couldn't resist

That said, my third question still has no answer.

[polita]

@PinpointTownes Sorry, we don't have a GitHub repo for WCF. RSACng support has been added to WCF 4.6.3.

[blowdart]

I did check with @polita first before closing, which was how I got the issues.

[kevinchalet]

@PinpointTownes Sorry, we don't have a GitHub repo for WCF. RSACng support has been added to WCF 4.6.3.

Just to make sure we're talking about the same thing, by RSACng support, I mean in code paths like this one: https://referencesource.microsoft.com/#System.IdentityModel/System/IdentityModel/Tokens/RsaSecurityKey.cs,210 (as you can see, it's not WCF-specific)

[brentschmaltz]

@PinpointTownes Similar to this issue: AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet#480, I think IdentityModel needs a 4.6.2 target. For 4.6.1 and below, if RSA is not an RSACryptoServiceProvider, we have to throw OR have a later failure.