TokenExtensions.CreateJwtPayload wraps JSON objects in JObject which is not serializable correctly

Try to create JwtToken with Claim(type: "json", value: Dictionary<string, int>{["foo"] = 1}) with at least one scope. The result is JWT with claim without original meaning.

The real cause of this is started here: https://github.com/IdentityServer/IdentityServer4/blob/3ff3b46698f48f164ab1b54d124125d63439f9d0/src/IdentityServer4/src/Extensions/TokenExtensions.cs#L92

And misusage later here: https://github.com/IdentityServer/IdentityServer4/blob/3ff3b46698f48f164ab1b54d124125d63439f9d0/src/IdentityServer4/src/Extensions/TokenExtensions.cs#L103...L112

A live example of the wrong serialization is here: https://dotnetfiddle.net/uOd8QS

An example in the IdentityServer scope

Source claim:

new Claim("json-claim", JsonConvert.SerializeObject(new Dictionary<string, int>{["foo"] = 1}), "json")

Expected JWT token:

{
...
  "scope": [
    "api",
    "offline_access"
  ],
  "json-claim": {
    "foo": 1
  }
}

Produced JWT token:

{
...
  "scope": [
    "api",
    "offline_access"
  ],
  "json-claim": {
    "foo": []
  }
}

It is caused by the Microsoft.IdentityModel.Json.Serialization.DefaultContractResolver._contractCache which maps JValue of the directory to a previously serialized array (scope).

I think the solution is to pass deserialized Json instead of JRaw.Parse result. At least it works in my custom TokenCreationService.

IdentityServer / IdentityServer4

TokenExtensions.CreateJwtPayload wraps JSON objects in JObject which is not serializable correctly #5385

Important update