accomodate for breaking changes in JWT handler

Author: leastprivilege

src/IdentityTokenValidator/IdentityTokenValidator.csproj

@@ -29,7 +29,7 @@
     <ItemGroup>
         <PackageReference Include="minver" Version="2.5.0" PrivateAssets="All" />
 
-        <PackageReference Include="System.IdentityModel.Tokens.Jwt" Version="6.9.0" />
+        <PackageReference Include="System.IdentityModel.Tokens.Jwt" Version="6.11.0" />
         <PackageReference Include="Microsoft.Extensions.Logging" Version="5.0.0" />
         <PackageReference Include="Microsoft.SourceLink.GitHub" Version="1.0.0" PrivateAssets="All" />
     </ItemGroup>

src/IdentityTokenValidator/JwtHandlerIdentityTokenValidator.cs

@@ -94,6 +94,14 @@ public async Task<IdentityTokenValidationResult> ValidateAsync(string identityTo
                     };
                 }
 
+                if (result.Exception is SecurityTokenUnableToValidateException)
+                {
+                    return new IdentityTokenValidationResult
+                    {
+                        Error = "unable_to_validate_token"
+                    };
+                }
+
                 throw result.Exception;
             }
 

test/JwtValidationTests/CodeFlowResponseTestsWithJwtValidation.cs

@@ -601,7 +601,7 @@ public async Task No_keyset_for_identity_token_should_fail()
             var result = await client.ProcessResponseAsync(url, state);
 
             result.IsError.Should().BeTrue();
-            result.Error.Should().Contain("invalid_signature");
+            result.Error.Should().Contain("unable_to_validate_token");
         }
 
         [Fact]
@@ -626,7 +626,7 @@ public async Task Untrusted_identity_token_should_fail()
             var result = await client.ProcessResponseAsync(url, state);
 
             result.IsError.Should().BeTrue();
-            result.Error.Should().Contain("invalid_signature");
+            result.Error.Should().Contain("unable_to_validate_token");
         }
 
         [Theory]