Azure-activedirectory-identitymodel-extensions-for-dotnet: Odd instructions in an exception from the JWT handler

[brockallen]

System.ArgumentException: IDX12709: JWT is not well formed: '[PII is hidden by default. Set the 'ShowPII' flag in IdentityModelEventSource.cs to true to reveal it.]'.

<PackageReference Include="System.IdentityModel.Tokens.Jwt" Version="5.2.1" />

[HolyNoodle]

Same here. Did you find any clue ?

[brentschmaltz]

@brockallen @HolyNoodle as part of our GDPR effort, by default we hide any stack or variable info in our logs. You can enable additional detail by setting IdentityModelEventSource.ShowPII = true, when setting up logs.

That said, this looks like a format issue, we'll look into it.

[MatthewSteeples]

I think the message just needs to be a bit clearer. The message references a .cs file, making it look like you need to edit something rather than set a static property

[ycrumeyrolle]

Valuable exception informations are hidden now. For example configuration errors are hard to understand, which is unrelated to PII.
Setting IdentityModelEventSource.ShowPII = true will lead to have this hardcoded for most developers.

A better approach would be to not expose PII within exception messages, or to obfuscate PII.
Or even better, to reduce the number of raised exceptions, remplaced by an error model.

[brentschmaltz]

@ycrumeyrolle @MatthewSteeples we talked about this and we think we will make these changes.
Write a log header the contains:
Date, Version, PII status indicating what API to use. Then for each exception just in a single phrase like: PII OFF.

[brockallen]

How do I set the IdentityModelEventSource.ShowPII flag for a single instance of a JwtSecurityTokenHandler?

[brentschmaltz]

@brockallen you can't it's a process setting.

[cxbxmxcx]

Is this fixed then?

[ghost]

It has been fixed to say "[PII is hidden]" I would prefer "[PII is hidden per GDPR]" or something like that.