Aspnetcore: ASP.NET Core 2.2 Signature validation failed in JwtBearer Authentication (just in Linux/MacOS)

[PejmanNik]

Describe the bug

After updating to 2.2 RSA signature cant' be verify in Linux and MacOS ( in windows it is ok).
I use this code in the startup to set authentication:

  services.AddAuthentication(options =>
            {
                options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
                options.DefaultSignInScheme = JwtBearerDefaults.AuthenticationScheme;
                options.DefaultScheme = JwtBearerDefaults.AuthenticationScheme;
            })
            .AddJwtBearer(config =>
            {
                config.Events = new API.Core.Security.JwtBearerEvents();
                config.RequireHttpsMetadata = !CurrentEnvironment.IsDevelopment();
                config.IncludeErrorDetails = CurrentEnvironment.IsDevelopment();
                config.SaveToken = true;
                config.TokenValidationParameters = new TokenValidationParameters()
                {
                    RequireSignedTokens = true,
                    ValidateIssuerSigningKey = true,
                    ValidateLifetime = true,
                    ValidateAudience = false,
                    ValidateIssuer = false,
                    IssuerSigningKey = new RsaSecurityKey(rsa)
                };

            });

After update in any endpoint with [Authorize] attribute in Linux or MacOS authentication middleware throw can't verify signature error.
in Older version or in windows it works just fine.

To Reproduce

Steps to reproduce the behavior:

1. Using this version of ASP.NET Core '2.2.101'
2. Add AddJwtBearer in Authentication
3. Run in Linux/MacOs
4. Call endpoint with [Authorize]
5. See the error

[leastprivilege]

Sounds like

https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/issues/1067

We had to roll back to 5.2.4 - 5.3.0 seems to have issues.

[Eilon]

Agree with @leastprivilege , so closing this issue. Thanks!

[leastprivilege]

Err. Closing that issue does not fix it.

[PejmanNik]

Thank you for closing and ignoring the issue.😑😑😐

[Eilon]

Sorry for the confusion, we must have mis-understood it. Re-opening so we can evaluate again.

[Eilon]

@leastprivilege so you're saying that if https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/issues/1067 is fixed, there's still more to do in ASP.NET Core to address this issue? If so, we're not seeing what that additional work would be. Can you provide more info?

[Tratcher]

Closing as IdentityModel is fixing the issue.

[PejmanNik]

How it fixing this issue?
I can't use Authentication with dotnet core 2.2 on any Mac or Linux system.

[Tratcher]

Update your IdentityModel dependencies to 5.4. https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/issues/1067#issuecomment-456445438

[PejmanNik]

It is work now 👍
Thank you so much @Tratcher