Azure-activedirectory-identitymodel-extensions-for-dotnet: Compile Error: SecurityTokenExpiredException exists in both 'Microsoft.IdentityModel.Tokens' and 'Microsoft.IdentityModel'

[z0nekill]

Hi there,

Looking for some guidance around this particular compilation issue.

Packages in use that are conflicting on the type "SecurityTokenExpiredException " which I'm catching in try/catch block:

  <package id="Microsoft.IdentityModel" version="6.1.7600.16394" targetFramework="net45" />
  <package id="Microsoft.IdentityModel.Tokens" version="5.2.4" targetFramework="net45" />

These packages are referenced by the SharePointPnPCoreOnline - however I don't think the problem lies with them?

Those packages are:

  <package id="SharePointPnP.IdentityModel.Extensions" version="1.2.4" targetFramework="net45" />
  <package id="SharePointPnPCoreOnline" version="3.1.1809" targetFramework="net45" />

Example code usage:

            bool contextTokenExpired = false;

            try
            {
                if (SharePointContextProvider.Current.GetSharePointContext(httpContext) != null)
                {
                    return RedirectionStatus.Ok;
                }
            }
            catch (SecurityTokenExpiredException)
            {
                contextTokenExpired = true;
            }

Full error:

Severity    Code    Description Project File    Line    Suppression State
Error   CS0433  The type 'SecurityTokenExpiredException' exists in both 'Microsoft.IdentityModel.Tokens, Version=5.2.4.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35' and 'Microsoft.IdentityModel, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35'    ... ...\SharePointContext.cs    333 N/A

Any guidance would be greatly appreciated!

Cheers

[brentschmaltz]

@z0nekill can you point me to the nuget package you are using?
A process cannot have Microsoft.IdentityModel 3.5 and Microsoft.IdentityModel 5.2.4 in memory at the same time.

[z0nekill]

Hey @brentschmaltz,

<package id="SharePointPnPCoreOnline" version="3.1.1809" targetFramework="net45" />

Is the core nuget package that references the two conflicting IdentityModel packages.

Is that what you're looking for?

[brentschmaltz]

@z0nekill yes thanks, that is what I am looking for.
Where did you get it?

[brentschmaltz]

@z0nekill to be specific, where did you get the nuget packages?

[z0nekill]

@brentschmaltz https://www.nuget.org/packages/SharePointPnPCoreOnline/

[brentschmaltz]

@z0nekill looks like we can't use those together. I'll have to investigate

[easyveazie]

I'm seeing the same thing with the nuget AppForSharePointOnlineWebToolkit v3.1.5

Error CS0433 The type 'SecurityTokenExpiredException' exists in both 'Microsoft.IdentityModel.Tokens, Version=5.3.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35' and 'Microsoft.IdentityModel, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35'

[easyveazie]

As a bandaid, I'm making the catch less specific and invalidating the token on any exception.

            try
            {
                if (SharePointContextProvider.Current.GetSharePointContext(httpContext) != null)
                {
                    return RedirectionStatus.Ok;
                }
            }
            catch
            {
                contextTokenExpired = true;
            }

[vinsaTimeparity]

Any updates on this issue , we are facing the same and have also made the catch less specific for now.

[henrik-me]

We currently have no good solution to this, we are actively discussing this challenge with the SPO team.

[brentschmaltz]

@z0nekill @vinsaTimeparity @easyveazie I am moving this to the 5.x milestone. We don't have a good solution, but want to keep this open.

[GeoK]

@z0nekill There is nothing that we can really do until SharePoint updates.

[tpalacino]

I slightly modified the bandaid posted by @easyveazie so it can flag the token expiration and allow the exception to bubble in other cases.
C# try { if (SharePointContextProvider.Current.GetSharePointContext(httpContext) != null) { return RedirectionStatus.Ok; } } catch (Exception ex) { if ("SecurityTokenExpiredException".Equals(ex.GetType().Name)) { contextTokenExpired = true; } else { throw; } }

[rezanid]

A better alternative might be to catch the base classes from the assemblies:

{ 
//
}
catch (Exception ex) when (
    ex is Microsoft.IdentityModel.Tokens.SecurityTokenValidationException ||
    ex is System.IdentityModel.Tokens.SecurityTokenExpiredException)
{
//
}