OpenIdConnectConfiguration not serializing properly

The OpenIdConnectConfiguration is not serializing the field jwks_uri field, the bellow example show the incorrect field naming (jwksUri).

The package to reproduce the behavior is Microsoft.IdentityModel.Protocols.OpenIdConnect version 5.5.0.

The problem caused is that the authenticationservice could not ask the authority the public key set to validate a token.

{
  "additionalData": {},
  "acrValuesSupported": [],
  "authorizationEndpoint": "https://localhost:4000/connect/authorization",
  "checkSessionIframe": null,
  "claimsSupported": [], "claimsLocalesSupported": [],
  "claimsParameterSupported": false,
  "claimTypesSupported": [],
  "displayValuesSupported": [],
  "endSessionEndpoint": null,
  "frontchannelLogoutSessionSupported": null,
  "frontchannelLogoutSupported": null,
  "grantTypesSupported": [],
  "httpLogoutSupported": false,
  "idTokenEncryptionAlgValuesSupported": [],
  "idTokenEncryptionEncValuesSupported": [],
  "idTokenSigningAlgValuesSupported": [],
  "issuer": "https://localhost:4000",
  "jwksUri": "https://localhost:4000/.well-known/openid-configuration/jwks",
  "jsonWebKeySet": {
    "additionalData": {},
    "keys": [
      {
        "additionalData": {},
        "alg": null,
        "crv": null,
        "d": null,
        "dp": null,
        "dq": null,
        "e": "AQAB",
        "k": null,
        "keyId": "319D93355237260601A940A962991084B835681A",
        "keyOps": [],
        "kid": "319D93355237260601A940A962991084B835681A",
        "kty": "RSA",
        "n": "4wyItVfNjf/3NVwA8z1ijlAz/SmGSdQ+U2M22TwR/vQWGmT3Fivg7Do9otPwTQBTIVkU3NnTyhB8jH0pe2LSqkVJXzwQjtma3aH/GaHMYTArB36xf5YESPWb1tvVmbIFFxtqaMZYnvUOYqh4c6yYBLPbQkKE8aSvYtEfvucA5XPwQU11sA9fRuScWO0psKBD1xtXZDB3vzv0JSZFmWB6OSCQcrBiBLFsGUlDogOCuLqN8g5xxjUE7gv7hRnUu6sm9lhEdzTskDw5zjr0mh093/PZ1M0UYMCg/M6TZmz+mdrd3r0Yq97am6mdFACe2v2tNXryy2iLrVBred6W+g8tjQ==",
        "oth": null,
        "p": null,
        "q": null,
        "qi": null,
        "use": "sig",
        "x": null,
        "x5c": [],
        "x5t": "319D93355237260601A940A962991084B835681A",
        "x5tS256": null,
        "x5u": null,
        "y": null,
        "keySize": 2048,
        "hasPrivateKey": false,
        "cryptoProviderFactory": {
          "cryptoProviderCache": {},
          "customCryptoProvider": null,
          "cacheSignatureProviders": true
        }
      }
    ],
    "skipUnresolvedJsonWebKeys": true
  },
  "logoutSessionSupported": false,
  "opPolicyUri": null,
  "opTosUri": null,
  "registrationEndpoint": null,
  "requestObjectEncryptionAlgValuesSupported": [],
  "requestObjectEncryptionEncValuesSupported": [],
  "requestObjectSigningAlgValuesSupported": [],
  "requestParameterSupported": false,
  "requestUriParameterSupported": false,
  "requireRequestUriRegistration": false,
  "responseModesSupported": [],
  "responseTypesSupported": [],
  "serviceDocumentation": null,
  "scopesSupported": [],
  "signingKeys": [],
  "subjectTypesSupported": [],
  "tokenEndpoint": "https://localhost:4000/connect/authentication",
  "tokenEndpointAuthMethodsSupported": [],
  "tokenEndpointAuthSigningAlgValuesSupported": [],
  "uiLocalesSupported": [],
  "userInfoEndpoint": null,
  "userInfoEndpointEncryptionAlgValuesSupported": [],
  "userInfoEndpointEncryptionEncValuesSupported": [],
  "userInfoEndpointSigningAlgValuesSupported": []
}

[cleferman]

Stumbled upon this today and wrecked my head for a few hours until I finally retrieved the discovery document “manually”. I was sure I configured the JWT middleware correctly but it never hit my /keys endpoint. I inspected the url a dozen times, it was correct but it turns out it was a serialization issue…

I’ll just leave this chunk of code here

        [HttpGet]
        public IActionResult GetConfiguration(CancellationToken cancellationToken)
        {
            var requestedUrlBase = $"{Request.Scheme}://{Request.Host}/";

            var configuration = new OpenIdConnectConfiguration
            {
                Issuer = securitySettings.Issuer,
                TokenEndpoint = requestedUrlBase + "token",
                JwksUri = requestedUrlBase + "keys",
            };

            return Ok(configuration);
        }

I looked into the OkObjectResult class and it seems it’s using the System.Text.Json serializer. I tried forcing the controllers to use the Newtonsoft.Json one but with no success services.AddControllers().AddNewtonsoftJson();

Inheriting from the OpenIdConnectConfiguration class and adding the jwks_uri property as @RogerioWagner mentioned works like a charm.

Sorry for bumping this, but it still seems to be an issue. Here’s to hoping the next guy finds this before losing their minds like I almost did.

[brentschmaltz]

@RogerioWagner @cleferman @chwarr this item was fixed in 6.x. Please feel free to re-open if you see issues in 6.x.