[Bug] OpenIdConnectConfigurationSerializer.cs bug (on case-insensitive property deserialization)

[stvkouvaris]

Which version of Microsoft.IdentityModel are you using?
Microsoft.IdentityModel.Protocols.OpenIdConnect 7.0.3

Where is the issue?
Microsoft.IdentityModel.Protocols.OpenIdConnect.OpenIdConnectConfigurationSerializer deserialization error.

Is this a new or an existing app?
The app is in production and I haven't upgraded Microsoft.IdentityModel.Protocols.OpenIdConnect, but started seeing this issue.

Repro

var oidcDiscoveryEndpoint = "my_discovery_endpoint";
var openIdConfigManager = new ConfigurationManager<OpenIdConnectConfiguration>(
            oidcDiscoveryEndpoint, 
            new OpenIdConnectConfigurationRetriever());
var openIdConfig = await openIdConfigManager.GetConfigurationAsync();

Expected behavior
Returns an OpenIdConnectConfiguration instance.

Actual behavior
System.InvalidOperationException: IDX20803: Unable to obtain configuration from: 'my_discovery_endpoint'. Will retry at '11/15/2023 1:20:12 PM +00:00'. Exception: 'System.Text.Json.JsonException: IDX11022: Expecting json reader to be positioned on 'JsonTokenType.StartArray', reader was positioned at: 'String', Reading: 'Microsoft.IdentityModel.Protocols.OpenIdConnect.OpenIdConnectConfiguration.response_modes_supported', Position: '172', CurrentDepth: '2', BytesConsumed: '179'.
at Microsoft.IdentityModel.Tokens.Json.JsonSerializerPrimitives.ReadStrings(Utf8JsonReader& reader, ICollection1 strings, String propertyName, String className, Boolean read) at Microsoft.IdentityModel.Protocols.OpenIdConnect.OpenIdConnectConfigurationSerializer.Read(Utf8JsonReader& reader, OpenIdConnectConfiguration config) at Microsoft.IdentityModel.Protocols.OpenIdConnect.OpenIdConnectConfigurationSerializer.Read(String json, OpenIdConnectConfiguration config) at Microsoft.IdentityModel.Protocols.OpenIdConnect.OpenIdConnectConfigurationSerializer.Read(String json) at Microsoft.IdentityModel.Protocols.OpenIdConnect.OpenIdConnectConfigurationRetriever.GetAsync(String address, IDocumentRetriever retriever, CancellationToken cancel) at Microsoft.IdentityModel.Protocols.ConfigurationManager1.GetConfigurationAsync(CancellationToken cancel)'.
---> System.Text.Json.JsonException: IDX11022: Expecting json reader to be positioned on 'JsonTokenType.StartArray', reader was positioned at: 'String', Reading: 'Microsoft.IdentityModel.Protocols.OpenIdConnect.OpenIdConnectConfiguration.response_modes_supported', Position: '172', CurrentDepth: '2', BytesConsumed: '179'.
at Microsoft.IdentityModel.Tokens.Json.JsonSerializerPrimitives.ReadStrings(Utf8JsonReader& reader, ICollection1 strings, String propertyName, String className, Boolean read) at Microsoft.IdentityModel.Protocols.OpenIdConnect.OpenIdConnectConfigurationSerializer.Read(Utf8JsonReader& reader, OpenIdConnectConfiguration config) at Microsoft.IdentityModel.Protocols.OpenIdConnect.OpenIdConnectConfigurationSerializer.Read(String json, OpenIdConnectConfiguration config) at Microsoft.IdentityModel.Protocols.OpenIdConnect.OpenIdConnectConfigurationSerializer.Read(String json) at Microsoft.AspNetCore.Authorization.AuthorizationMiddleware.Invoke(HttpContext context) at Microsoft.AspNetCore.Authentication.AuthenticationMiddleware.Invoke(HttpContext context) at Microsoft.AspNetCore.Localization.RequestLocalizationMiddleware.Invoke(HttpContext context) at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.Http.HttpProtocol.ProcessRequests[TContext](IHttpApplication1 application)

Possible solution
There is an obvious issue with the OpenIdConnectConfigurationSerializer.cs and the way it deserializes case insensitive properties.

[jmprieur]

@stvkouvaris. Thanks for reporting
I'm trying to understand how we didn't chat this earlier: which Identity provider are you using ?

[stvkouvaris]

@jmprieur No problem! I am using WSO2.

[brentschmaltz]

@stvkouvaris can ou share the json you are reading?

[stvkouvaris]

@brentschmaltz Sure. You can check the commit d1b229f. The sample json 'OpenIdConnectMetadataVariableCaseNames' used to break the code.

[jennyf19]

included in 7.3.1 release