dotnet user-jwts fails to parse tokens it creates

[enricoferrari]

Is there an existing issue for this?

• I have searched the existing issues

Describe the bug

.net 8.0.403 Microsoft.IdentityModel.JsonWebTokens.JsonWebToken can not parse sub claims. (Even when the token is created by dotnet user-jwts)

To recreate:

1. Run: dotnet user-jwts create --claim "sub=test"
2. Run: dotnet user-jwts print {id-of-claim-from-step-1}

Result:
IDX12723: Unable to decode the payload '[PII of type 'System.String' is hidden. For more details, see https://aka.ms/IdentityModel/PII.]' as Base64Url encoded string.

Expected Behavior

dotnet user-jwts print is able to parse the token and print details to the console

Steps To Reproduce

To recreate:

1. Run: dotnet user-jwts create --claim "sub=test"
2. Run: dotnet user-jwts print {id-of-claim-from-step-1}

Result:
IDX12723: Unable to decode the payload '[PII of type 'System.String' is hidden. For more details, see https://aka.ms/IdentityModel/PII.]' as Base64Url encoded string.

Exceptions (if any)

Debugging this further in a server when parsing this token you can see that the inner exception details are unable to pares the sub claim:

Microsoft.IdentityModel.Tokens.SecurityTokenMalformedException: IDX14100: JWT is not well formed, there are no dots (.). The token needs to be in JWS or JWE Compact Serialization Format. (JWS): 'EncodedHeader.EndcodedPayload.EncodedSignature'. (JWE): 'EncodedProtectedHeader.EncodedEncryptedKey.EncodedInitializationVector.EncodedCiphertext.EncodedAuthenticationTag'. ---> System.ArgumentException: IDX14101: Unable to decode the payload '[PII of type 'Microsoft.IdentityModel.Logging.SecurityArtifact' is hidden. For more details, see https://aka.ms/IdentityModel/PII.]' as Base64Url encoded string. ---> System.Text.Json.JsonException: IDX11020: The JSON value of type: 'StartArray', could not be converted to 'JsonTokenType.String or JsonTokenType.Number'. Reading: 'Microsoft.IdentityModel.JsonWebTokens.JsonWebToken.sub', Position: '52', CurrentDepth: '1', BytesConsumed: '53'. at Microsoft.IdentityModel.Tokens.Json.JsonSerializerPrimitives.ReadStringOrNumberAsString(Utf8JsonReader& reader, String propertyName, String className, Boolean read) at Microsoft.IdentityModel.JsonWebTokens.JsonWebToken.CreatePayloadClaimSet(Byte[] bytes, Int32 length) at Microsoft.IdentityModel.Tokens.Base64UrlEncoding.Decode[T](String input, Int32 offset, Int32 length, Func3 action)
at Microsoft.IdentityModel.JsonWebTokens.JsonWebToken.CreateClaimSet(String rawString, Int32 startIndex, Int32 length, Func3 action) at Microsoft.IdentityModel.JsonWebTokens.JsonWebToken.ReadToken(String encodedJson) --- End of inner exception stack trace --- at Microsoft.IdentityModel.JsonWebTokens.JsonWebToken.ReadToken(String encodedJson) at Microsoft.IdentityModel.JsonWebTokens.JsonWebToken..ctor(String jwtEncodedString) at Microsoft.IdentityModel.JsonWebTokens.JsonWebTokenHandler.ReadToken(String token, TokenValidationParameters validationParameters) --- End of inner exception stack trace ---

.NET Version

8.0.403

Anything else?

No response

[martincostello]

This is likely caused by #52286.

If you search for "no dots" in closed issues you'll see various issues that trace back to it.

[MackinnonBuck]

@enricoferrari, does the suggestion mentioned in this comment resolve the issue?

[enricoferrari]

@enricoferrari, does the suggestion mentioned in this comment resolve the issue?

Adding Microsoft.IdentityModel.JsonWebTokens and Microsoft.IdentityModel.Tokens to the project did not help.

[enricoferrari]

As an update to this I was able to work around this using the the full name-identifier claim path instead of sub:
dotnet user-jwts create --claim "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier=testId"

This also works as expected when you include name:
dotnet user-jwts create --name testusername --claim "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier=testId"