Microsoft.IdentityModel.Protocols.OpenIdConnect 7 - mtls_endpoint_aliases

[eirikurharaldsson]

Where is the issue?
Microsoft.IdentityModel.Protocols.OpenIdConnect 7.0.3 and later.
The parsing of metadata silenty failes, when openid metadata includes a json element: mtls_endpoint_aliases
Example of the section:
"mtls_endpoint_aliases": {
"token_endpoint": "https://idpserver/oauth/v2/oauth-token",
"revocation_endpoint": "https://idpserver/oauth/v2/oauth-revoke",
"introspection_endpoint": "https://idpserver/oauth/v2/oauth-introspect",
"pushed_authorization_request_endpoint": "https://idpserver/oauth/v2/oauth-authorize/par",
"userinfo_endpoint": "https://idpserver/oauth/v2/oauth-userinfo"
},

Everything value after this section is ignored by OpenConfigurationRetriver
See below:

I originally posted the issue on dotnet because this bug affects the JwtBearer middleware, but was told that it belonged here instead.
dotnet/aspnetcore#52330

The app is in production and I have downgraded from version 8 of JwtBearer middleware as a workaround to an older version one which is using version 6 of OpenIdConnect, which does not include this issue

Repro

var configManager = new ConfigurationManager<OpenIdConnectConfiguration>(
       $"{jwtAuthority}/.well-known/openid-configuration",
          new OpenIdConnectConfigurationRetriever(),
             new HttpDocumentRetriever(new HttpClient()));

// GetConfigurationAsync has a time interval that must pass before new http request will be issued.
var configuration = await configManager.GetConfigurationAsync(new CancellationToken());

Console.WriteLine(configuration.JwksUri);

var issuers = new[] { configuration.Issuer };
var issuerSigningKeys = configuration.SigningKeys;

foreach (var issuer in issuers)
{
    Console.WriteLine(issuer);
}

foreach (var issuerSigningKey in issuerSigningKeys)
{
    Console.WriteLine(issuerSigningKey);
}

Expected behavior
By using our Console app example (in Steps to Reproduce)
JwksUri has value and is written to the screen. (Expected)
same goes for Issuers and SigningKeys (Expected)
This used to work in version 6. But broke in version 7+

[keegan-caruso]

Hello, can you try the version release this week? 7.4.0

If I'm understanding correctly #2491 should have fixed this

[eirikurharaldsson]

This works with 7.4.0

[keegan-caruso]

thanks for confirming!