There may be problems with version 4.3.0.

[maliming]

Confirm you've already contributed to this project or that you sponsor it

• I confirm I'm a sponsor or a contributor

Version

4.x

abpframework/abp#16479

Describe the bug

A bug was found in Identity Model version 6.30.0

AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet#2059

We are using it in 4.3.

https://github.com/openiddict/openiddict-core/blob/4.3.0/Directory.Packages.props#LL41C1-L41C114

[kevinchalet]

Thanks for the report, @maliming!

I'm not able to reproduce this issue in any of the OpenIddict samples so I suspect it only occurs when referencing either the OIDC or JWT bearer ASP.NET Core packages: both of these packages reference System.IdentityModel.Tokens.Jwt, a package which is not referenced/used by OpenIddict itself (that depends on the newer IdentityModel JWT stack).

So, if you reference Microsoft.AspNetCore.Authentication.JwtBearer (or the OIDC package), System.IdentityModel.Tokens.Jwt 6.15.1 is indirectly referenced. And given that the IM team probably introduced a breaking change in their internal helpers, it doesn't play nicely with Microsoft.IdentityModel.Tokens version 6.30.0.

Can you please try to explicitly add a reference to System.IdentityModel.Tokens.Jwt 6.30.0 to see if it helps?

[maliming]

Thanks @kevinchalet

Since it doesn't affect OpenIddict, I closed it.

There will be an error if you use AddJwtBearer or AddOpenIdConnect.

👍

[kevinchalet]

@maliming my pleasure.

That would be interesting to know whether explicitly referencing System.IdentityModel.Tokens.Jwt 6.30.0 with OpenIddict 4.3.0 fixes this error.

[maliming]

hi

We have to degrade the openiddict to 4.2, haven't tried explicitly referencing. but I guess it will work.

AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet#2059 (comment)

[kevinchalet]

We have to degrade the openiddict to 4.2, haven't tried explicitly referencing. but I guess it will work.

Makes sense, but the problem will reappear if people update OpenIddict in their ABP app without also using the latest System.IdentityModel.Tokens.Jwt, so it's not a perfect solution either.

[satlom]

I also was forced to downgrade to OpenIdDict to 4.2 to get it to work.
[https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/issues/2059#issuecomment-1543397271]