Microsoft.AspNetCore.Authentication.JwtBearer 7.0.11 requires >= 7.0.0 of Microsoft.IdentityModel.Protocols.OpenIdConnect

[steingran]

Is there an existing issue for this?

• I have searched the existing issues

Describe the bug

I updated to the latest Microsoft.AspNetCore.Authentication.JwtBearer version (7.0.11), but I got this exception in my tests:
System.TypeLoadException
Could not load type 'Microsoft.IdentityModel.Json.JsonConvert' from assembly 'Microsoft.IdentityModel.Tokens, Version=7.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35'.
at Microsoft.IdentityModel.Protocols.OpenIdConnect.OpenIdConnectConfigurationRetriever.GetAsync(String address, IDocumentRetriever retriever, CancellationToken cancel)
at System.Runtime.CompilerServices.AsyncMethodBuilderCore.Start[TStateMachine](TStateMachine& stateMachine)
at Microsoft.IdentityModel.Protocols.OpenIdConnect.OpenIdConnectConfigurationRetriever.GetAsync(String address, IDocumentRetriever retriever, CancellationToken cancel)
at Microsoft.IdentityModel.Protocols.OpenIdConnect.OpenIdConnectConfigurationRetriever.Microsoft.IdentityModel.Protocols.IConfigurationRetriever<Microsoft.IdentityModel.Protocols.OpenIdConnect.OpenIdConnectConfiguration>.GetConfigurationAsync(String address, IDocumentRetriever retriever, CancellationToken cancel)
at Microsoft.IdentityModel.Protocols.ConfigurationManager`1.GetConfigurationAsync(CancellationToken cancel)

Based on this post on StackOverflow (https://stackoverflow.com/a/77121911/12390882) the problem is that Microsoft.AspNetCore.Authentication.JwtBearer allows >= 6.15.1 of Microsoft.IdentityModel.Protocols.OpenIdConnect, and not >= 7.0.0 as it should be (https://www.nuget.org/packages/Microsoft.AspNetCore.Authentication.JwtBearer/7.0.11#dependencies-body-tab).

Expected Behavior

I expect no new exceptions from one version of Microsoft.AspNetCore.Authentication.JwtBearer to another that are not explicitly mentioned in the Release Notes

Steps To Reproduce

No response

Exceptions (if any)

System.TypeLoadException
Could not load type 'Microsoft.IdentityModel.Json.JsonConvert' from assembly 'Microsoft.IdentityModel.Tokens, Version=7.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35'.
at Microsoft.IdentityModel.Protocols.OpenIdConnect.OpenIdConnectConfigurationRetriever.GetAsync(String address, IDocumentRetriever retriever, CancellationToken cancel)
at System.Runtime.CompilerServices.AsyncMethodBuilderCore.Start[TStateMachine](TStateMachine& stateMachine)
at Microsoft.IdentityModel.Protocols.OpenIdConnect.OpenIdConnectConfigurationRetriever.GetAsync(String address, IDocumentRetriever retriever, CancellationToken cancel)
at Microsoft.IdentityModel.Protocols.OpenIdConnect.OpenIdConnectConfigurationRetriever.Microsoft.IdentityModel.Protocols.IConfigurationRetriever<Microsoft.IdentityModel.Protocols.OpenIdConnect.OpenIdConnectConfiguration>.GetConfigurationAsync(String address, IDocumentRetriever retriever, CancellationToken cancel)
at Microsoft.IdentityModel.Protocols.ConfigurationManager`1.GetConfigurationAsync(CancellationToken cancel)

.NET Version

7.0.11

Anything else?

No response

[martincostello]

When a new version of ASP.NET Core ships the dependency versions that aren't part of the inbox product are typically frozen and not updated. I believe an upper-bound on the dependency range isn't specified so that if a new major version is released consumers of these applications aren't prevented from upgrading to it if it works for them.

Version 7.0.0 of Microsoft.IdentityModel.Protocols.OpenIdConnect was only published in the last few weeks and is unrelated to ASP.NET Core 7 - the proximity of the version numbers is a coincidence.

ASP.NET Core 8 will ship with a dependency on version 7.0.0 of these libraries.

Check that you don't have an implicit reference to a different IdentityModel library that is causing a mix of 6.x.x and 7.0.0 versions in your application. Have you recently updated a dependency other than an Microsoft.AspNetCore.* one which explicitly or implicitly adds a dependency on version 7 of the IdentityModel libraries?

Hi @steingran. We have added the "Needs: Author Feedback" label to this issue, which indicates that we have an open question for you before we can take further action. This issue will be closed automatically in 7 days if we do not hear back from you by then - please feel free to re-open it if you come back to this issue after that time.

This issue has been automatically marked as stale because it has been marked as requiring author feedback but has not had any activity for 4 days. It will be closed if no further activity occurs within 3 days of this comment. If it is closed, feel free to comment when you are able to provide the additional information and we will re-investigate.

See our Issue Management Policies for more information.

[steingran]

After digging in our code it was revealed we did indeed have a mix of 6.x and 7.x versions of the IdentityModel library. We solved it by adding explicit references to Microsoft.IdentityModel.Protocols.OpenIdConnect version 7.0.0 in order to only use 7.x versions of this nuget. And the problem was solved.

Thank you for the swift response! 👍

[brgrz]

You can also run into the same issue if one of your projects within the same solution references some other System.IdentityModel packages eg. System.IdentityModel.Tokens.Jwt with higher version than 6.x

[completej]

You can also run into the same issue if one of your projects within the same solution references some other System.IdentityModel packages eg. System.IdentityModel.Tokens.Jwt with higher version than 6.x

Thank you for this. Ran into this today.