JsonWebToken.TryGetPayloadValue does not support Aggregated and Distributed Claims

[mancyc]

We have adapted to SAL for token validation, but in an effort to make some further optimizations I am trying to use JsonWebToken.TryGetPayloadValue to fetch value based on claim type. azure-activedirectory-identitymodel-extensions-for-dotnet/JsonWebToken.cs at b24470757799a9d1d75f5f16314857f6bdc444d8 · AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet · GitHub

It does not work for _claim_names and _claim_sources. I checked my decoded payload and that seems to have this key, but below loc returns false

bool claimFound = subjectToken.TryGetPayloadValue("_claim_names", out string claimValue);

These are Aggregated and distributed Claims as per openid specs, (https://openid.net/specs/openid-connect-core-1_0.html#IDToken Section 5.6.2)

I am forced to do a linear search on token.Claims to obtain my ClaimType value for these claims. Requesting a feature to support these claims

[jennyf19]

@mancyc which claims do you see, the long names or the short names? What are claim_names?

[mancyc]

@jennyf19, I see various other claims too(short names) and JsonWebToken.TryGetPayloadValue works for the rest of them except the 2 mentioned in the issue. Here's my test decoded token for your reference { "nbf": 1652482253, "exp": 1652569253, "iss": "https://127.0.0.1/adfs/11111111-bbbb-3333-dddd-555555555555/", "aud": "https://vault.inprocess.net", "tid": "11111111-bbbb-3333-dddd-555555555555", "oid": "d55efd00-8e7d-49d2-8d7a-b48548e3a5f9", "sub": "d55efd00-8e7d-49d2-8d7a-b48548e3a5f9", "upn": "manygroupstest@aztestkmsbvtoutlook.ccsctp.net", "_claim_names": { "groups": "src1" }, "_claim_sources": { "src1": { "endpoint": "https://127.0.0.1/adfs/graph/11111111-bbbb-3333-dddd-555555555555/users/manygroupstest/getMemberObjects" } } }

[brentschmaltz]

@mancyc what if anything is returned from subjectToken.TryGetPayloadValue("_claim_names", out string claimValue);

what happens if you call: subjectToken.TryGetPayloadValue("_claim_names", out IList claimValues);

We currently only offer support for normal claims.

[mancyc]

out variable is always null.

Btw, subjectToken.Claims has the full list but I am trying to avoid iterating over the list