Azure-activedirectory-identitymodel-extensions-for-dotnet: X509SecurityKey.KeyId update breaks IdentityServer4 clients

[Zenuka]

I've updated Microsoft.IdentityModel.Tokens from version 5.3.0 to 5.4.0 and the KeyId has been changed from thumbprint to base64 encoded hash of the certificate. See: https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/commit/760fa3046cc36591c9f7835031745fcd625cf6ec#diff-ad9f507af4d8334a3a5dbcafbb0ded30

I've got IdentityServer4 running and this changes the kid (KeyId) in the openid connect endpoint .well-known/openid-configuration/jwks which breaks JWT validation on my clients. The currently logged in users have a token from a different (now non-existing) keyid when I deploy this update.

[brentschmaltz]

@Zenuka How does this change the 'kid' in the OIDC discovery endpoint?

[Zenuka]

The KeyId property is used of the JWT token signing certificate as kid in the openid connect endpoint. Changing the value breaks active tokens because they have a different KeyId. Does that help explain things?

[HitDaCa]

This change will brake any existing application which uses X509SecurityKey and expects to validate certificate Thumbprints through the originally offered KeyId.

E.g. this change could likely also break Identity Server 4's commercial SSO plugin if the receiving party validates for thumbprints.

[brockallen]

Yea, this is a breaking change in a patch. Why was this change needed?

[brentschmaltz]

@brockallen We had a servicing request, internally.
We moved those folks over to an internal 6.x version that we are preparing for the Core 3.0 release.

We will roll this back and talk about how we should move forward.
We upgraded our 'matching' semantics { kid X x5t } so that may be enough.

[leastprivilege]

too many breaking changes in patch or minor releases with this library. Too bad there is no real alternative.

[brentschmaltz]

@leastprivilege do you have a recommendation for a set of tests we could run to ensure we avoid such issues in the future?

[brentschmaltz]

@leastprivilege rolled back with https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/pull/1140
Will try to be more careful, sorry for the break.