TokenEndpoint empty when referencing Microsoft.IdentityModel.Tokens.Saml nuget package

[saberone]

I have some strange behavior when using OpenIdConnect authentication. Everything works fine, but as soon as I reference the Microsoft.IdentityModel.Tokens.Saml 8.0.2 (i also tried older versions) I got the following exception. This exceptions happens on the "way back" from de identity provider (POST on signin-oidc).

InvalidOperationException: An invalid request URI was provided. Either the request URI must be an absolute URI or BaseAddress must be set.
System.Net.Http.HttpClient.PrepareRequestMessage(HttpRequestMessage request)

AuthenticationFailureException: An error was encountered while handling the remote login.
Microsoft.AspNetCore.Authentication.RemoteAuthenticationHandler<TOptions>.HandleRequestAsync()

And after investigating I saw that _configuration?.TokenEndpoint is null, at the below line of code, as soon as I run with a reference to Microsoft.IdentityModel.Tokens.Saml nuget package.

aspnetcore/src/Security/Authentication/OpenIdConnect/src/OpenIdConnectHandler.cs

Line 991 in 258f8ba

var requestMessage = new HttpRequestMessage(HttpMethod.Post, tokenEndpointRequest.TokenEndpoint ?? _configuration?.TokenEndpoint);

The .csproj with packagerefences looks like this:

<Project Sdk="Microsoft.NET.Sdk.Web">

  <PropertyGroup>
    <TargetFramework>net8.0</TargetFramework>
    <Nullable>enable</Nullable>
    <ImplicitUsings>enable</ImplicitUsings>
    <UserSecretsId>7f837761-f406-4779-ac6c-3f1cbd16fb67</UserSecretsId>
  </PropertyGroup>

  <ItemGroup>
    <PackageReference Include="Azure.Identity" Version="1.12.0" />
    <PackageReference Include="Azure.Security.KeyVault.Certificates" Version="4.6.0" />
    <PackageReference Include="IdentityModel" Version="7.0.0" />
    <PackageReference Include="Microsoft.Data.SqlClient" Version="5.2.1" />
    <PackageReference Include="Microsoft.EntityFrameworkCore.SqlServer" Version="8.0.7" />
    <PackageReference Include="Microsoft.EntityFrameworkCore.Tools" Version="8.0.7">
      <PrivateAssets>all</PrivateAssets>
      <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
    </PackageReference>
    <PackageReference Include="Microsoft.IdentityModel.Tokens.Saml" Version="8.0.2" />
    <PackageReference Include="Scrutor" Version="4.2.2" />
    <PackageReference Include="System.Configuration.ConfigurationManager" Version="8.0.0" />
    <PackageReference Include="System.Text.RegularExpressions" Version="4.3.1" />
    <PackageReference Include="Yarp.ReverseProxy" Version="2.1.0" />
    <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="8.0.8" />
    <PackageReference Include="Microsoft.AspNetCore.Authentication.OpenIdConnect" Version="8.0.8" />
    <PackageReference Include="Microsoft.AspNetCore.Authentication.WsFederation" Version="8.0.8" />
    <PackageReference Include="Microsoft.ApplicationInsights.AspNetCore" Version="2.22.0" />
  </ItemGroup>

</Project>

And I found that I need to reference Microsoft.IdentityModel.Tokens.Saml in order for WsFederation to work. So that's the reason that I have reference that package.

Is there something I should configure/override to make this work, or is this a bug?

[MackinnonBuck]

@saberone, could you please provide us with your <PROJECT_NAME>.deps.json in the bin folder? We think this may be caused by a version mismatch between various Microsoft.IdentityModel.* packages.

[MackinnonBuck]

Possibly related: #52099

[MackinnonBuck]

And I found that I need to reference Microsoft.IdentityModel.Tokens.Saml in order for WsFederation to work. So that's the reason that I have reference that package.

Could you clarify why this was necessary? What happens if you don't reference Microsoft.IdentityModel.Tokens.Saml?

[MackinnonBuck]

We think this may be caused by a version mismatch between various Microsoft.IdentityModel.* packages.

i.e., all Microsoft.IdentityModel.* package versions should be 8.0.x.

[halter73]

The output of dotnet list package --include-transitive might be easier to read than the <PROJECT_NAME>.deps.json file in the bin directory.

[saberone]

@saberone, could you please provide us with your <PROJECT_NAME>.deps.json in the bin folder? We think this may be caused by a version mismatch between various Microsoft.IdentityModel.* packages.

I have attached the <PROJECT_NAME>.deps.json file.
RedactedName.deps.json

Output of dotnet list package --include-transitive

Project '<Redacted>' has the following package references
   [net8.0]:
   Top-level Package                                        Requested   Resolved
   > Azure.Identity                                         1.12.0      1.12.0
   > Azure.Security.KeyVault.Certificates                   4.6.0       4.6.0
   > IdentityModel                                          7.0.0       7.0.0
   > Microsoft.ApplicationInsights.AspNetCore               2.22.0      2.22.0
   > Microsoft.AspNetCore.Authentication.JwtBearer          8.0.7       8.0.7
   > Microsoft.AspNetCore.Authentication.OpenIdConnect      8.0.7       8.0.7
   > Microsoft.AspNetCore.Authentication.WsFederation       7.0.20      7.0.20
   > Microsoft.Data.SqlClient                               5.2.1       5.2.1
   > Microsoft.EntityFrameworkCore.SqlServer                8.0.7       8.0.7
   > Microsoft.EntityFrameworkCore.Tools                    8.0.7       8.0.7
   > Microsoft.IdentityModel.Tokens.Saml                    8.0.2       8.0.2
   > Scrutor                                                4.2.2       4.2.2
   > System.Configuration.ConfigurationManager              8.0.0       8.0.0
   > System.Text.RegularExpressions                         4.3.1       4.3.1
   > Yarp.ReverseProxy                                      2.1.0       2.1.0

   Transitive Package                                                  Resolved
   > Azure.Core                                                        1.40.0
   > Humanizer.Core                                                    2.14.1
   > Microsoft.ApplicationInsights                                     2.22.0
   > Microsoft.ApplicationInsights.DependencyCollector                 2.22.0
   > Microsoft.ApplicationInsights.EventCounterCollector               2.22.0
   > Microsoft.ApplicationInsights.PerfCounterCollector                2.22.0
   > Microsoft.ApplicationInsights.WindowsServer                       2.22.0
   > Microsoft.ApplicationInsights.WindowsServer.TelemetryChannel      2.22.0
   > Microsoft.AspNetCore.Hosting                                      2.1.1
   > Microsoft.AspNetCore.Hosting.Abstractions                         2.1.1
   > Microsoft.AspNetCore.Hosting.Server.Abstractions                  2.1.1
   > Microsoft.AspNetCore.Http                                         2.1.22
   > Microsoft.AspNetCore.Http.Abstractions                            2.1.1
   > Microsoft.AspNetCore.Http.Extensions                              2.1.1
   > Microsoft.AspNetCore.Http.Features                                2.1.1
   > Microsoft.AspNetCore.WebUtilities                                 2.1.1
   > Microsoft.Bcl.AsyncInterfaces                                     6.0.0
   > Microsoft.CodeAnalysis.Analyzers                                  3.3.3
   > Microsoft.CodeAnalysis.Common                                     4.5.0
   > Microsoft.CodeAnalysis.CSharp                                     4.5.0
   > Microsoft.CodeAnalysis.CSharp.Workspaces                          4.5.0
   > Microsoft.CodeAnalysis.Workspaces.Common                          4.5.0
   > Microsoft.Data.SqlClient.SNI.runtime                              5.2.0
   > Microsoft.EntityFrameworkCore                                     8.0.7
   > Microsoft.EntityFrameworkCore.Abstractions                        8.0.7
   > Microsoft.EntityFrameworkCore.Analyzers                           8.0.7
   > Microsoft.EntityFrameworkCore.Design                              8.0.7
   > Microsoft.EntityFrameworkCore.Relational                          8.0.7
   > Microsoft.Extensions.Caching.Abstractions                         8.0.0
   > Microsoft.Extensions.Caching.Memory                               8.0.0
   > Microsoft.Extensions.Configuration                                3.1.0
   > Microsoft.Extensions.Configuration.Abstractions                   8.0.0
   > Microsoft.Extensions.Configuration.EnvironmentVariables           2.1.1
   > Microsoft.Extensions.Configuration.FileExtensions                 3.1.0
   > Microsoft.Extensions.Configuration.Json                           3.1.0
   > Microsoft.Extensions.DependencyInjection                          8.0.0
   > Microsoft.Extensions.DependencyInjection.Abstractions             8.0.0
   > Microsoft.Extensions.DependencyModel                              8.0.1
   > Microsoft.Extensions.FileProviders.Abstractions                   3.1.0
   > Microsoft.Extensions.FileProviders.Physical                       3.1.0
   > Microsoft.Extensions.FileSystemGlobbing                           3.1.0
   > Microsoft.Extensions.Hosting.Abstractions                         2.1.1
   > Microsoft.Extensions.Logging                                      8.0.0
   > Microsoft.Extensions.Logging.Abstractions                         8.0.0
   > Microsoft.Extensions.Logging.ApplicationInsights                  2.22.0
   > Microsoft.Extensions.ObjectPool                                   2.1.1
   > Microsoft.Extensions.Options                                      8.0.0
   > Microsoft.Extensions.Primitives                                   8.0.0
   > Microsoft.Identity.Client                                         4.61.3
   > Microsoft.Identity.Client.Extensions.Msal                         4.61.3
   > Microsoft.IdentityModel.Abstractions                              8.0.2
   > Microsoft.IdentityModel.JsonWebTokens                             7.1.2
   > Microsoft.IdentityModel.Logging                                   8.0.2
   > Microsoft.IdentityModel.Protocols                                 7.1.2
   > Microsoft.IdentityModel.Protocols.OpenIdConnect                   7.1.2
   > Microsoft.IdentityModel.Protocols.WsFederation                    6.35.0
   > Microsoft.IdentityModel.Tokens                                    8.0.2
   > Microsoft.IdentityModel.Xml                                       8.0.2
   > Microsoft.Net.Http.Headers                                        2.1.1
   > Microsoft.NETCore.Platforms                                       3.1.0
   > Microsoft.NETCore.Targets                                         1.1.3
   > Microsoft.SqlServer.Server                                        1.0.0
   > Mono.TextTemplating                                               2.2.1
   > System.Buffers                                                    4.5.0
   > System.ClientModel                                                1.0.0
   > System.CodeDom                                                    4.4.0
   > System.Collections                                                4.3.0
   > System.Collections.Immutable                                      6.0.0
   > System.Composition                                                6.0.0
   > System.Composition.AttributedModel                                6.0.0
   > System.Composition.Convention                                     6.0.0
   > System.Composition.Hosting                                        6.0.0
   > System.Composition.Runtime                                        6.0.0
   > System.Composition.TypedParts                                     6.0.0
   > System.Diagnostics.Debug                                          4.3.0
   > System.Diagnostics.DiagnosticSource                               6.0.1
   > System.Diagnostics.EventLog                                       8.0.0
   > System.Diagnostics.PerformanceCounter                             6.0.0
   > System.Globalization                                              4.3.0
   > System.IdentityModel.Tokens.Jwt                                   7.1.2
   > System.IO                                                         4.3.0
   > System.IO.FileSystem                                              4.3.0
   > System.IO.FileSystem.AccessControl                                4.7.0
   > System.IO.FileSystem.Primitives                                   4.3.0
   > System.IO.Hashing                                                 7.0.0
   > System.IO.Pipelines                                               6.0.3
   > System.Memory                                                     4.5.4
   > System.Memory.Data                                                1.0.2
   > System.Numerics.Vectors                                           4.5.0
   > System.Reflection                                                 4.3.0
   > System.Reflection.Metadata                                        6.0.1
   > System.Reflection.Primitives                                      4.3.0
   > System.Resources.ResourceManager                                  4.3.0
   > System.Runtime                                                    4.3.1
   > System.Runtime.Caching                                            8.0.0
   > System.Runtime.CompilerServices.Unsafe                            6.0.0
   > System.Runtime.Extensions                                         4.3.0
   > System.Runtime.Handles                                            4.3.0
   > System.Runtime.InteropServices                                    4.3.0
   > System.Security.AccessControl                                     4.7.0
   > System.Security.Cryptography.ProtectedData                        8.0.0
   > System.Security.Principal.Windows                                 4.7.0
   > System.Text.Encoding                                              4.3.0
   > System.Text.Encoding.CodePages                                    6.0.0
   > System.Text.Encoding.Extensions                                   4.3.0
   > System.Text.Encodings.Web                                         8.0.0
   > System.Text.Json                                                  8.0.4
   > System.Threading                                                  4.3.0
   > System.Threading.Channels                                         6.0.0
   > System.Threading.Tasks                                            4.3.0
   > System.Threading.Tasks.Extensions                                 4.5.4
   > System.Xml.ReaderWriter                                           4.3.0
   > System.Xml.XmlDocument                                            4.3.0

And after some more debugging, I found out that something went wrong with parsing the json from the OpenIdConnect discovery endpoint. That issue is fixed in a newer of Microsoft.IdentityModel.Protocols.OpenIdConnect (8.0.2). And I can fix my issue by explicitly reference the nuget package.

But how can I prevent this kind of issues, in that the implicitly referenced (transitive) package is of an older version. I was expecting that by refencing the Microsoft.AspNetCore.Authentication.OpenIdConnect 8.0.8 version that, the Microsoft packages that it depends on would also be in the 8.x.x range.