Microsoft.Owin.Security.OpenIdConnect not compatible with the latest Microsoft.IdentityModel.XX packages.

[sankj]

Hello,

We host a MVC .NET web application that takes a dependency on: https://www.nuget.org/packages/Microsoft.Owin.Security.OpenIdConnect/#versions-body-tab to implement OAuth2.0.

What we have found so far is that Microsoft.Owin.Security.OpenIdConnect 4.2.2 takes a dependency on Microsoft.IdentityModel.xxx - 6.11.1.0. However, we had to upgrade the identity model packages to Microsoft.IdentityModel.xxx to 7.6.0. What we have found is Microsoft.Owin.Security.OpenIdConnect 4.2.2 does not work with Microsoft.IdentityModel.xxx to 7.6.0.

We have not seen any update to the above package as well since 2022.

Symptoms: The project builds successfully. However, our application throws an "Unable to decode payload" error when OAuth is being made. What we found out further was that: Microsoft.IdentityModel.xxx - 6.11.1.0 takes dependency on Newtonsoft Microsoft.IdentityModel.xxx to 7.6.0 takes dependency on System.Text.Json

Possibly that is the reason we are getting Unable to decode error ?

What are the recommended next steps to go forward here to help us unblock?

Thank you!

[danroth27]

@adityamandaleeka

[eerhardt]

@brentschmaltz @jennyf19 - Do you know if the latest Microsoft.IdentityModel packages are broken w.r.t. Microsoft.Owin.Security.OpenIdConnect?

@sankj - any possibililty of creating a repro of the issue?

[sankj]

@brentschmaltz , @jeffhandley, could you please let us know if this is true ? "latest Microsoft.IdentityModel packages are broken w.r.t. Microsoft.Owin.Security.OpenIdConnect?"

Thank you @eerhardt for asking around to see if this is a known issue. What kind of repro are you looking for with respect to this ? We have our app (its a url) in our test environment, where I can create the repro. What data would help you investigate this further?

[eerhardt]

What kind of repro are you looking for with respect to this ? We have our app (its a url) in our test environment, where I can create the repro. What data would help you investigate this further?

Check out https://github.com/dotnet/runtime/blob/main/CONTRIBUTING.md#writing-a-good-bug-report.

Typically posting the code for an application that reproduces the problem (link to a github repo or a .zip file, etc).

[sankj]

@eerhardt, thanks!

I followed the template: (https://github.com/dotnet/runtime/issues/new?assignees=&labels=&template=01_bug_report.yml) that you provided and described our issue. This has the error / link to the code that produces the error, etc. Please let me know if you need further information.

Description We host a MVC .NET web application that takes a dependency on: https://www.nuget.org/packages/Microsoft.Owin.Security.OpenIdConnect/#versions-body-tab to implement OAuth2.0.

What we have found so far is that Microsoft.Owin.Security.OpenIdConnect 4.2.2 takes a dependency on Microsoft.IdentityModel.xxx - 6.11.1.0. However, we had to upgrade the identity model packages to Microsoft.IdentityModel.xxx to 7.6.0. What we have found is Microsoft.Owin.Security.OpenIdConnect 4.2.2 does not work with Microsoft.IdentityModel.xxx to 7.6.0.

We have not seen any update to the package: (https://www.nuget.org/packages/Microsoft.Owin.Security.OpenIdConnect) since 2022.

Symptoms: The project builds successfully. However, our application throws an "Unable to decode payload" error when OAuth is being made. What we found out further was that: Microsoft.IdentityModel.xxx - 6.11.1.0 takes dependency on Newtonsoft Microsoft.IdentityModel.xxx to 7.6.0 takes dependency on System.Text.Json

Possibly that is the reason we are getting Unable to decode error ?

What are the recommended next steps to go forward here to help us unblock?

Reproduction Steps Code snippet: Repo link: https://microsoft.visualstudio.com/EngSys/_git/nebula?path=/Core/Nebula%20WFE/CloudMan.Web/App_Start/Startup.Auth.cs&version=GBmain&line=56&lineEnd=71&lineStartColumn=1&lineEndColumn=20&lineStyle=plain&_a=contents

Code: app.UseOpenIdConnectAuthentication( new OpenIdConnectAuthenticationOptions { ClientId = clientId, Authority = authority, PostLogoutRedirectUri = postLogoutRedirectUri, Notifications = new OpenIdConnectAuthenticationNotifications { AuthenticationFailed = async context => { await Task.Yield(); context.HandleResponse(); context.Response.Redirect("Home/Error?message=" + context.Exception.Message); } } });

Our MVC application uses the above code snippet to perform the OAuth2.0 authentication. Here, the authentication fails while doing the OAuth2.0.

Repro steps:

1. Go to the Url: https://cloudmanbvt.corp.microsoft.com/
2. This is what gets displayed during authentication. 2.a Server Error in '/' Application. The resource cannot be found. Description: HTTP 404. The resource you are looking for (or one of its dependencies) could have been removed, had its name changed, or is temporarily unavailable. Please review the following URL and make sure that it is spelled correctly. Requested URL: /Home/Error Version Information: Microsoft .NET Framework Version:4.0.30319; ASP.NET Version:4.8.4762.0

2.b In the web Url address bar, we see this error: https://cloudmanbvt.corp.microsoft.com/Home/Error?message=IDX12723:%20Unable%20to%20decode%20the%20payload%20%27eyJhdWQiOiJkZTZhYzY5My1lZWNkLTRkMWUtYjJiZi0xOGQxMDkxMzhjYWMiLCJpc3MiOiJodHRwczovL3N0cy53aW5kb3dzLm5ldC83MmY5ODhiZi04NmYxLTQxYWYtOTFhYi0yZDdjZDAxMWRiNDcvIiwiaWF0IjoxNzI5MjgxMzMxLCJuYmYiOjE3MjkyODEzMzEsImV4cCI6MTcyOTI4NTIzMSwiYWlvIjoiQWFRQVcvOFlBQUFBeVo2Z3VHclVrWHBoQmpzZXFtSUVHTzFDVWtjdHFwYUVpS1ZLOXpKZFlRZk5ydWpTN05uRCtPRTRLSStCaUJDZlZaMnp0SUNKc2lKZ3FPMjY0N05GZHdyM1MrSTQ4dDRrdUhhMEhzMmo1UjJDRWFZcVBVUWw4YXZ1ekc3aWNOckxSclRlUmU0Ly9mTm5pV0NneEwyS2QvNnVjMGRtTEZsYThoTUFrVUFwVkdQRm5Oc0NPRWJrYWtlc1VSQ2hyVFdlVTZueFRGVlloYnBZNmRxZUQ2dDJ1QT09IiwiYW1yIjpbInJzYSIsIm1mYSJdLCJjX2hhc2giOiJuaWFoeVk1cFBJQXI0amlaODJCWGt3IiwiZmFtaWx5X25hbWUiOiJKb3NoaSIsImdpdmVuX25hbWUiOiJTYW5rZXQiLCJpcGFkZHIiOiIyMC4yMzYuMTAuMTYzIiwibmFtZSI6IlNhbmtldCBKb3NoaSIsIm5vbmNlIjoiNjM4NjQ4Nzg0Mjk3MjQxNjQ1Lk9XSTFOREEzTXpjdFltUXpNQzAwT0RrMUxUbGhZVFV0TXpFME16ZzRZbVV5WldZeE1XVmlPVEV5WlRFdFkyRXlaQzAwWWpjMExUZzFZell0WW1FNVpURmpabU15TWpoayIsIm9pZCI6IjQ0YmI4YTU5LTgyYmItNDAxZi1hYjVmLTJmMTkxOTcyNmFkOCIsIm9ucHJlbV9zaWQiOiJTLTEtNS0yMS0yMTI3NTIxMTg0LTE2MDQwMTI5MjAtMTg4NzkyNzUyNy01MDY3NzczIiwicmgiOiIxLkFSb0F2NGo1Y3ZHR3IwR1JxeTE4MEJIYlI1UEdhdDdON2g1TnNyOFkwUWtUakt3YUFHTWFBQS4iLCJzdWIiOiJ4N3VJRU1zREpkX0tNN1lWQTExMjhadVlkRGR3LWxTSG9jYUxINGE2RFFRIiwidGlkIjoiNzJmOTg4YmYtODZmMS00MWFmLTkxYWItMmQ3Y2QwMTFkYjQ3IiwidW5pcXVlX25hbWUiOiJzYW5rZXRqQG1pY3Jvc29mdC5jb20iLCJ1cG4iOiJzYW5rZXRqQG1pY3Jvc29mdC5jb20iLCJ1dGkiOiJERm1hOFp3QlZVT3U2SHROcldFYUFBIiwidmVyIjoiMS4wIn0%27%20as%20Base64Url%20encoded%20string.

Expected behavior: Expected behavior is that we get authenticated and are redirected to the following Url (https://cloudmanbvt.corp.microsoft.com/) and see the page display. Image:

Actual behavior As I mentioned earlier in the repro steps this is the error we see.

2.a Server Error in '/' Application. The resource cannot be found. Description: HTTP 404. The resource you are looking for (or one of its dependencies) could have been removed, had its name changed, or is temporarily unavailable. Please review the following URL and make sure that it is spelled correctly. Requested URL: /Home/Error Version Information: Microsoft .NET Framework Version:4.0.30319; ASP.NET Version:4.8.4762.0

2.b In the web Url address bar, we see this error: https://cloudmanbvt.corp.microsoft.com/Home/Error?message=IDX12723:%20Unable%20to%20decode%20the%20payload%20%27eyJhdWQiOiJkZTZhYzY5My1lZWNkLTRkMWUtYjJiZi0xOGQxMDkxMzhjYWMiLCJpc3MiOiJodHRwczovL3N0cy53aW5kb3dzLm5ldC83MmY5ODhiZi04NmYxLTQxYWYtOTFhYi0yZDdjZDAxMWRiNDcvIiwiaWF0IjoxNzI5MjgxMzMxLCJuYmYiOjE3MjkyODEzMzEsImV4cCI6MTcyOTI4NTIzMSwiYWlvIjoiQWFRQVcvOFlBQUFBeVo2Z3VHclVrWHBoQmpzZXFtSUVHTzFDVWtjdHFwYUVpS1ZLOXpKZFlRZk5ydWpTN05uRCtPRTRLSStCaUJDZlZaMnp0SUNKc2lKZ3FPMjY0N05GZHdyM1MrSTQ4dDRrdUhhMEhzMmo1UjJDRWFZcVBVUWw4YXZ1ekc3aWNOckxSclRlUmU0Ly9mTm5pV0NneEwyS2QvNnVjMGRtTEZsYThoTUFrVUFwVkdQRm5Oc0NPRWJrYWtlc1VSQ2hyVFdlVTZueFRGVlloYnBZNmRxZUQ2dDJ1QT09IiwiYW1yIjpbInJzYSIsIm1mYSJdLCJjX2hhc2giOiJuaWFoeVk1cFBJQXI0amlaODJCWGt3IiwiZmFtaWx5X25hbWUiOiJKb3NoaSIsImdpdmVuX25hbWUiOiJTYW5rZXQiLCJpcGFkZHIiOiIyMC4yMzYuMTAuMTYzIiwibmFtZSI6IlNhbmtldCBKb3NoaSIsIm5vbmNlIjoiNjM4NjQ4Nzg0Mjk3MjQxNjQ1Lk9XSTFOREEzTXpjdFltUXpNQzAwT0RrMUxUbGhZVFV0TXpFME16ZzRZbVV5WldZeE1XVmlPVEV5WlRFdFkyRXlaQzAwWWpjMExUZzFZell0WW1FNVpURmpabU15TWpoayIsIm9pZCI6IjQ0YmI4YTU5LTgyYmItNDAxZi1hYjVmLTJmMTkxOTcyNmFkOCIsIm9ucHJlbV9zaWQiOiJTLTEtNS0yMS0yMTI3NTIxMTg0LTE2MDQwMTI5MjAtMTg4NzkyNzUyNy01MDY3NzczIiwicmgiOiIxLkFSb0F2NGo1Y3ZHR3IwR1JxeTE4MEJIYlI1UEdhdDdON2g1TnNyOFkwUWtUakt3YUFHTWFBQS4iLCJzdWIiOiJ4N3VJRU1zREpkX0tNN1lWQTExMjhadVlkRGR3LWxTSG9jYUxINGE2RFFRIiwidGlkIjoiNzJmOTg4YmYtODZmMS00MWFmLTkxYWItMmQ3Y2QwMTFkYjQ3IiwidW5pcXVlX25hbWUiOiJzYW5rZXRqQG1pY3Jvc29mdC5jb20iLCJ1cG4iOiJzYW5rZXRqQG1pY3Jvc29mdC5jb20iLCJ1dGkiOiJERm1hOFp3QlZVT3U2SHROcldFYUFBIiwidmVyIjoiMS4wIn0%27%20as%20Base64Url%20encoded%20string.

Regression? Yes, this is working when the Microsoft.Owin.Security.OpenIdConnect 4.2.2 dll is referencing Microsoft.IdentityModel.xxx - 6.11.1.0. However, once we upgraded Microsoft.IdentityModel.xxx - 6.11.1.0 to Microsoft.IdentityModel.xxx to 7.6.0, we started getting the above error.

Known Workarounds None

Configuration Which version of .NET is the code running on? .NET Framework 4.7.2

What OS and version, and what distro if applicable? this is running on a VM with OS22

What is the architecture (x64, x86, ARM, ARM64)? X64

Other information Symptoms: The project builds successfully. However, our application throws an "Unable to decode payload" error when OAuth is being made. What we found out further was that: Microsoft.IdentityModel.xxx - 6.11.1.0 takes dependency on Newtonsoft Microsoft.IdentityModel.xxx to 7.6.0 takes dependency on System.Text.Json

Would that be a reason why Microsoft.Owin.Security.OpenIdConnect not compatible with the latest Microsoft.IdentityModel.XX packages ?