MissingMethodException when using version 6.28.1

Version

<PackageReference Include="Microsoft.IdentityModel.Tokens" Version="6.28.1" />

Where is the issue?

• S.IM.Tokens.Jwt

Is this a new or an existing app? The app is in production and I haven’t upgraded Microsoft.IdentityModel.*, but started seeing this issue.

Repro Update NuGet package from version 6.27.0 to 6.28.1. Run code below:

public bool TryValidateJwtToken(string token, IEnumerable<string> validAudiences, out IEnumerable<Claim> claims)
{
    claims = null;
    try
    {
        var handler = new JwtSecurityTokenHandler();
        var parameters = new TokenValidationParameters
        {
            RequireSignedTokens = true,
            IssuerSigningKeys = discoveryResponse.KeySet.Keys.Select(key => new RsaSecurityKey(new RSAParameters
            {
                Exponent = Base64UrlEncoder.DecodeBytes(key.E),
                Modulus = Base64UrlEncoder.DecodeBytes(key.N)
            })
            { KeyId = key.Kid }),
            ValidateIssuer = true,
            ValidIssuer = discoveryResponse.Issuer,
            ValidateAudience = true,
            ValidAudiences = validAudiences,
        };
        var claimsPrincipal = handler.ValidateToken(token, parameters, out _);
        claims = claimsPrincipal.Claims;
    }
    catch (Exception ex)
    {
        // Goes BOOM!
    }

    return claims != null;
}

Expected behavior In version 6.27.0 we got parsed claims. That is what we expect to happen.

Actual behavior In version 6.28.1 we’re getting the following error both when targeting netstandard2.0 (which we use) and net6.0:

"Method not found: 'Boolean Microsoft.IdentityModel.Tokens.TokenUtilities.IsRecoverableConfiguration(Microsoft.IdentityModel.Tokens.TokenValidationParameters, Microsoft.IdentityModel.Tokens.BaseConfiguration, Microsoft.IdentityModel.Tokens.BaseConfiguration ByRef)'."

Stack trace:

{System.MissingMethodException: Method not found: 'Boolean Microsoft.IdentityModel.Tokens.TokenUtilities.IsRecoverableConfiguration(Microsoft.IdentityModel.Tokens.TokenValidationParameters, Microsoft.IdentityModel.Tokens.BaseConfiguration, Microsoft.IdentityModel.Tokens.BaseConfiguration ByRef)'.
   at System.IdentityModel.Tokens.Jwt.JwtSecurityTokenHandler.ValidateToken(String token, JwtSecurityToken outerToken, TokenValidationParameters validationParameters, SecurityToken& signatureValidatedToken)
   at System.IdentityModel.Tokens.Jwt.JwtSecurityTokenHandler.ValidateToken(String token, TokenValidationParameters validationParameters, SecurityToken& validatedToken)
   at [REDACTED].TryValidateJwtToken(String token, IEnumerable`1 validAudiences, IEnumerable`1& claims) in [REDACTED]\TokenValidator.cs:line [REDACTED]}

[brentschmaltz]

@jouni-kantola we had started an effort to check that all assemblies are the same version to avoid such issues. That effort was bumped from the list. I pointed out this issue to the team, adding that logic may get a higher priority now.

[sipsorcery]

I’m getting the same exception after updating to the latest stabke nuget packages. My relevant packages seem to be:

<PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="7.0.5" />
<PackageReference Include="Microsoft.AspNetCore.Authentication.OpenIdConnect" Version="7.0.5" />

The resulting System.IdentityModel.Tokens.Jwt assembly version in my executable directory is 6.24.0.31013.

Update:

Explicitly adding a package reference resolves the problem. This wasn’t needed previously.

<PackageReference Include="System.IdentityModel.Tokens.Jwt" Version="6.29.0" />