20

I was recently forced to update my System.IdentityModel.Tokens.Jwt NuGet package to 5.1.4 because of another NuGet package. Most of the code after changes seem easy enough to solve, but now ConfigurationManager<OpenIdConnectConfiguration>() takes two arguments instead of one! I can not find any example of how to use this new version of the Configuration manager!

I use it as part of this code:

string stsDiscoveryEndpoint = string.Format("{0}/.well-known/openid-configuration", authority);

ConfigurationManager<OpenIdConnectConfiguration> configManager = new ConfigurationManager<OpenIdConnectConfiguration>(stsDiscoveryEndpoint, IConfigurationRetriever<>);

OpenIdConnectConfiguration config = await configManager.GetConfigurationAsync();
_issuer = config.Issuer;
_signingTokens = config.SigningTokens.ToList();

_stsMetadataRetrievalTime = DateTime.UtcNow;

Can anyone let me know what arguments ConfigurationManager expects

2 Answers 2

35

I found that in order to make ConfigurationManager work with version >=5.1.4 of the System.IdentityModel.Tokens.Jwt NuGet package you have to add OpenIdConnectConfigurationRetriever() as the second argument.

The correct invocation of ConfigurationManager is then:

ConfigurationManager<OpenIdConnectConfiguration> configManager = new ConfigurationManager<OpenIdConnectConfiguration>(stsDiscoveryEndpoint, new OpenIdConnectConfigurationRetriever());
4
  • 1
    You can also use AddJwtBearer(o => o.options.MetadataAddress = "")
    – cSteusloff
    Oct 29, 2020 at 15:41
  • 1
    @cSteusloff Since this question is about instantiating ConfigurationManager I think you need a bit more context for your comment to make sense.
    – Jeppe
    Oct 31, 2020 at 8:04
  • 1
    You can create the default implementation of ConfigurationManager<OpenIdConnectConfiguration> when you set the MetadataAddress. In your example you create only the default Manager.
    – cSteusloff
    Nov 6, 2020 at 9:04
  • Hi @Jeppe, do you know what is the difference between JwtBearerOptions.Authority and JwtBearerOptions.MetadataAddress. I set only JwtBearerOptions.Authority ="my-openid-connect" url and the token validation is working, and seems to discover the publick keys from the given address assigned to JwtBearerOptions.Authority.
    – Shaheer
    Jun 8, 2022 at 8:39
5

Depending on what you want to do, you could just change the code to make a call to the Configuration retriever, like this:

        string issuerEndpoint = "https://my.auth.server";
        var openidConfiguration = await OpenIdConnectConfigurationRetriever.GetAsync(
                    $"{issuerEndpoint}/.well-known/openid-configuration", CancellationToken.None);

        app.UseJwtBearerAuthentication(
        new Microsoft.Owin.Security.Jwt.JwtBearerAuthenticationOptions()
        {
            TokenValidationParameters =
                new TokenValidationParameters
                {
                    ValidIssuer = openidConfiguration.Issuer,
                    ValidateAudience = false,
                    IssuerSigningKeys = openidConfiguration.SigningKeys,
                    IssuerSigningTokens = openidConfiguration.SigningTokens
                }
        });
3
  • Thanks a lot Diego, looks like a nice alternative if some of the helper classes do not work. Unfortunately it can not work for me as the code is in a method to just retrieve and verify the token, not for login.
    – Jeppe
    Sep 5, 2018 at 7:00
  • Ahh, okay, just posted it here to make available to others, maybe you could find a similar solution to your problem. Sep 5, 2018 at 9:34
  • 5
    Be aware that OpenIdConnectConfigurationRetriever.GetAsync() doesn't cache the retrieved configuration, while ConfigurationManager<>.GetConfigurationAsync() does so
    – torvin
    May 12, 2020 at 0:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.