Can no longer open signalr hub conection using bearer token after upgrading from 9.0.4 to 9.0.9

[groogiam]

Is there an existing issue for this?

• I have searched the existing issues

Describe the bug

I recently updated from 9.0.4 to 9.0.9 and the following signalr connection code no longer works. I have verified the bearer token is set. No other code has changed in my solution other than than the package versions.

_myHubConnection = new HubConnectionBuilder()
                .WithUrl(new Uri(serverBaseUri, HubRelativePath),
                    options => { options.AccessTokenProvider = () => Task.FromResult(BearerToken); })
                .WithAutomaticReconnect()
                .Build();

await _myHubConnection .StartAsync()

I receive the following error

Unknown Error
System.AggregateException: One or more errors occurred. (Response status code does not indicate success: 401 (Unauthorized).)

Expected Behavior

SignalR authentication should work as it did in 9.0.4

Steps To Reproduce

See code above.

Exceptions (if any)

No response

.NET Version

9.0.305

Anything else?

No response

[groogiam]

I think this might be related to this. AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet#2926.

Microsoft.AspNetCore.Authentication.JwtBearer (v9.0.9) seems to be referencing a very old version of Microsoft.IdentityModel.Tokens

Microsoft.AspNetCore.Authentication.JwtBearer (v9.0.9)                                                                                                                                                                                                                                                     
      │  └─ Microsoft.IdentityModel.Protocols.OpenIdConnect (v8.0.1)
      │     ├─ Microsoft.IdentityModel.Protocols (v8.0.1)
      │     │  └─ Microsoft.IdentityModel.Tokens (v8.0.1)
      │     └─ System.IdentityModel.Tokens.Jwt (v8.0.1)                                                                                                                                                                                                                                                             
      │        ├─ Microsoft.IdentityModel.JsonWebTokens (v8.0.1)
      │        │  └─ Microsoft.IdentityModel.Tokens (v8.0.1)
      │        └─ Microsoft.IdentityModel.Tokens (v8.0.1) 

[BrennanConroy]

I think this might be related to this. AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet#2926.

Microsoft.AspNetCore.Authentication.JwtBearer (v9.0.9) seems to be referencing a very old version of Microsoft.IdentityModel.Tokens

Microsoft.AspNetCore.Authentication.JwtBearer (v9.0.9)                                                                                                                                                                                                                                                     
      │  └─ Microsoft.IdentityModel.Protocols.OpenIdConnect (v8.0.1)
      │     ├─ Microsoft.IdentityModel.Protocols (v8.0.1)
      │     │  └─ Microsoft.IdentityModel.Tokens (v8.0.1)
      │     └─ System.IdentityModel.Tokens.Jwt (v8.0.1)                                                                                                                                                                                                                                                             
      │        ├─ Microsoft.IdentityModel.JsonWebTokens (v8.0.1)
      │        │  └─ Microsoft.IdentityModel.Tokens (v8.0.1)
      │        └─ Microsoft.IdentityModel.Tokens (v8.0.1) 

All versions of 9.0 are using that "very old" version, so unlikely that has anything to do with the problem.

A change that was made that could affect auth, depending on your app, is aspnet/Announcements#517 which explains how to fix your application.

[groogiam]

@BrennanConroy Thanks for pointing me to that breaking change, but that does not seem to be the reason for the issue, at least in my local dev environment. This is what is being logged.

info: Microsoft.AspNetCore.Hosting.Diagnostics[1]

      Request starting "HTTP/2" "POST" "https"://"localhost:44300""""/MyHub/negotiate""?negotiateVersion=1" - null 0

info: Microsoft.AspNetCore.Authentication.JwtBearer.JwtBearerHandler[1]

      Failed to validate the token.

      System.MissingMethodException: Method not found: 'Void Microsoft.IdentityModel.Tokens.TokenValidationResult..ctor(Microsoft.IdentityModel.Tokens.SecurityToken, Microsoft.IdentityModel.Tokens.TokenHandler, Microsoft.IdentityModel.Tokens.TokenValidationParameters, System.String, System.Collections.Generic.List`1<Microsoft.IdentityModel.Tokens.ValidatedToken>)'.

         at Microsoft.IdentityModel.JsonWebTokens.JsonWebTokenHandler.ValidateTokenPayloadAsync(JsonWebToken jsonWebToken, TokenValidationParameters validationParameters, BaseConfiguration configuration)

         at System.Runtime.CompilerServices.AsyncMethodBuilderCore.Start[TStateMachine](TStateMachine& stateMachine)

         at Microsoft.IdentityModel.JsonWebTokens.JsonWebTokenHandler.ValidateTokenPayloadAsync(JsonWebToken jsonWebToken, TokenValidationParameters validationParameters, BaseConfiguration configuration)

         at Microsoft.IdentityModel.JsonWebTokens.JsonWebTokenHandler.ValidateJWSAsync(JsonWebToken jsonWebToken, TokenValidationParameters validationParameters, BaseConfiguration configuration)

info: Microsoft.AspNetCore.Authentication.JwtBearer.JwtBearerHandler[7]

      "Bearer" was not authenticated. Failure message: "Method not found: 'Void Microsoft.IdentityModel.Tokens.TokenValidationResult..ctor(Microsoft.IdentityModel.Tokens.SecurityToken, Microsoft.IdentityModel.Tokens.TokenHandler, Microsoft.IdentityModel.Tokens.TokenValidationParameters, System.String, System.Collections.Generic.List`1<Microsoft.IdentityModel.Tokens.ValidatedToken>)'."

info: Microsoft.AspNetCore.Authorization.DefaultAuthorizationService[2]

      Authorization failed. "These requirements were not met:

      DenyAnonymousAuthorizationRequirement: Requires an authenticated user."

info: Microsoft.AspNetCore.Authentication.JwtBearer.JwtBearerHandler[12]

      AuthenticationScheme: "Bearer" was challenged.

info: Microsoft.AspNetCore.Hosting.Diagnostics[2]

      Request finished "HTTP/2" "POST" "https"://"localhost:44300""""/MyHub/negotiate""?negotiateVersion=1" - 401 0 null 35.609ms

I seem to be able to work around the issue by adding adding an explicit package reference to

<PackageReference Include="Microsoft.IdentityModel.Protocols.OpenIdConnect" Version="8.14.0" />

I'm still not exactly sure what is going on because even without that explicit reference I still seem to be resolving version well after the 8.0.1

but I still get the error.

For some reason the error was caught and logged as info so I can't get a full stack trace to see what code is calling the non existent constructor. Either way it might be a good idea to make sure there is no framework code using that constructor. Thanks.

[BrennanConroy]

Seems like a "known" change. AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet#3259 (comment)

8.12.1 changed the internal ctor of TokenValidationResult and so if you have a mix of IdentityModel versions (you have 8.14.0 and 8.6.1) you can hit issues like this.

[groogiam]

@BrennanConroy Ok that makes more sense. The original issue I posted made it look like it was removed much earlier. Thanks you for spending the time to help me work through this.