Migrate Owin.Security.OAuth.Introspection and Owin.Security.OAuth.Validation to Katana 4 and IdentityModel 5

Author: kevinchalet

NuGet.config

@@ -3,6 +3,7 @@
   <packageSources>
     <add key="NuGet" value="https://api.nuget.org/v3/index.json" />
     <add key="aspnetcore" value="https://dotnet.myget.org/F/aspnetcore-dev/api/v3/index.json" />
+    <add key="aspnetkatana" value="https://dotnet.myget.org/F/katana-dev/api/v3/index.json" />
     <add key="aspnet-contrib" value="https://www.myget.org/F/aspnet-contrib/api/v3/index.json" />
   </packageSources>
 </configuration>

build/dependencies.props

@@ -3,15 +3,14 @@
   <PropertyGroup>
     <AspNetCoreVersion>2.0.0-*</AspNetCoreVersion>
     <CoreFxVersion>4.4.0-*</CoreFxVersion>
-    <IdentityModelVersion>1.0.4.403061554</IdentityModelVersion>
     <IdentityModelCoreVersion>2.1.3-*</IdentityModelCoreVersion>
     <JetBrainsVersion>10.3.0</JetBrainsVersion>
     <JsonNetVersion>10.0.2</JsonNetVersion>
     <MoqVersion>4.7.63</MoqVersion>
     <NetHttpVersion>4.3.2</NetHttpVersion>
     <NetStandardImplicitPackageVersion>2.0.0-*</NetStandardImplicitPackageVersion>
     <NetStandardLibraryNetFrameworkVersion>2.0.0-*</NetStandardLibraryNetFrameworkVersion>
-    <OwinVersion>3.0.1</OwinVersion>
+    <OwinVersion>4.0.0-*</OwinVersion>
     <RuntimeFrameworkVersion>2.0.0-*</RuntimeFrameworkVersion>
     <TestSdkVersion>15.3.0-*</TestSdkVersion>
     <XunitVersion>2.3.0-*</XunitVersion>

src/Owin.Security.OAuth.Introspection/OAuthIntrospectionConfiguration.cs

@@ -10,6 +10,7 @@
 using System.Threading.Tasks;
 using JetBrains.Annotations;
 using Microsoft.IdentityModel.Protocols;
+using Microsoft.IdentityModel.Protocols.OpenIdConnect;
 using Newtonsoft.Json;
 
 namespace Owin.Security.OAuth.Introspection
@@ -31,10 +32,7 @@ public OAuthIntrospectionConfiguration()
         /// </summary>
         /// <param name="json">The JSON payload used to initialize the current instance.</param>
         public OAuthIntrospectionConfiguration([NotNull] string json)
-            : base(json)
-        {
-            JsonConvert.PopulateObject(json, this);
-        }
+            : base(json) { }
 
         /// <summary>
         /// Gets or sets the introspection endpoint address.

src/Owin.Security.OAuth.Introspection/OAuthIntrospectionMiddleware.cs

@@ -141,11 +141,9 @@ public OAuthIntrospectionMiddleware(
                                                     "'RequireHttpsMetadata' is not set to 'false'.", nameof(options));
                     }
 
-                    Options.ConfigurationManager = new ConfigurationManager<OAuthIntrospectionConfiguration>(
-                        Options.MetadataAddress.AbsoluteUri, new OAuthIntrospectionConfiguration.Retriever(),
-                        (IDocumentRetriever) Activator.CreateInstance(
-                            type: typeof(OpenIdConnectConfiguration).Assembly.GetType("Microsoft.IdentityModel.Protocols.HttpDocumentRetriever"),
-                            args: Options.HttpClient));
+                    options.ConfigurationManager = new ConfigurationManager<OAuthIntrospectionConfiguration>(
+                        options.MetadataAddress.AbsoluteUri, new OAuthIntrospectionConfiguration.Retriever(),
+                        new HttpDocumentRetriever(options.HttpClient) { RequireHttps = options.RequireHttpsMetadata });
                 }
             }
         }

src/Owin.Security.OAuth.Introspection/Owin.Security.OAuth.Introspection.csproj

@@ -16,14 +16,10 @@
     <PackageReference Include="JetBrains.Annotations" Version="$(JetBrainsVersion)" PrivateAssets="All" />
     <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="$(AspNetCoreVersion)" />
     <PackageReference Include="Microsoft.Extensions.Logging" Version="$(AspNetCoreVersion)" />
-    <PackageReference Include="Microsoft.IdentityModel.Protocol.Extensions" Version="$(IdentityModelVersion)" />
+    <PackageReference Include="Microsoft.IdentityModel.Protocols.OpenIdConnect" Version="$(IdentityModelCoreVersion)" />
     <PackageReference Include="Microsoft.Owin.Security.Interop" Version="$(AspNetCoreVersion)" />
     <PackageReference Include="Newtonsoft.Json" Version="$(JsonNetVersion)" />
     <PackageReference Include="System.Net.Http" Version="$(NetHttpVersion)" />
   </ItemGroup>
 
-  <ItemGroup>
-    <Reference Include="System.IdentityModel" />
-  </ItemGroup>
-
 </Project>