Azure-activedirectory-identitymodel-extensions-for-dotnet: JwtSecurityTokenHandler wrong message on exception

[theolivenbaum]

Just hit this today, there seems to be a bug with this line:

https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/blob/e4f8a0c3cd1d7d0e62a2e48be7bdc91a7fdddb24/src/System.IdentityModel.Tokens.Jwt/JwtSecurityTokenHandler.cs#L1437

Where it prints the object type instead of the actual message in the StringBuilder.

````
Microsoft.IdentityModel.Tokens.SecurityTokenInvalidSignatureException: IDX10503: Signature validation failed. Keys tried: 'System.Text.StringBuilder'.
Exceptions caught:
'System.Text.StringBuilder'.
token: 'System.IdentityModel.Tokens.Jwt.JwtSecurityToken'.
at System.IdentityModel.Tokens.Jwt.JwtSecurityTokenHandler.ValidateSignature(String token, TokenValidationParameters validationParameters)
at System.IdentityModel.Tokens.Jwt.JwtSecurityTokenHandler.ValidateToken(String token, TokenValidationParameters validationParameters, SecurityToken& validatedToken)

````

The fix should be as simple as calling .ToString() before:
````csharp
throw LogHelper.LogExceptionMessage(new SecurityTokenDecryptionFailedException(LogHelper.FormatInvariant(TokenLogMessages.IDX10603, keysAttempted.ToString(), exceptionStrings.ToString(), jwtToken.RawData)));

````

[brentschmaltz]

@theolivenbaum thanks for reporting this, sorry for the hassle.

[senylity]

It happens on expired tokens as well

IDX10223: Lifetime validation failed. The token is expired. ValidTo: 'System.DateTime', Current time: 'System.DateTime'

Any time frame on a fix?

[AaronKoller]

I agree. I am having the same issue too.

[brentschmaltz]

@AaronKoller @senylity @theolivenbaum this is currently marked for the next release, we have a planning on Monday and we will set a realistic date for the release.

[brentschmaltz]

@AaronKoller @senylity @theolivenbaum the issue here is that IdentityModelEventSource.ShowPII is false by default. In this case, we apply filtering sensitive items are filtered.
see: https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/blob/5810cd81dd3d7a802f111005f42990dc8ebb0aa7/src/Microsoft.IdentityModel.Logging/IdentityModelEventSource.cs#L303

We recognize the need to adjust this for an application that is running.
We have these issues that address this:
https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/issues/1274

https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/issues/1452

If you would like us to consider these in next months release, please put a mark on those issues.

[thinkards]

It happens on expired tokens as well

IDX10223: Lifetime validation failed. The token is expired. ValidTo: 'System.DateTime', Current time: 'System.DateTime'

Any time frame on a fix?

FYI, I was able to work around this with:

Microsoft.IdentityModel.Logging.IdentityModelEventSource.ShowPII = true;

in the first line of ConfigureServices in my Startup.cs file. I'm using .NET 5.