Trigger metadata refresh for token decryption errors #3149

pmaytak · 2025-02-25T06:31:14Z

Summary

aims to address decryption issues by triggering a metadata refresh when token decryption fails due to the token's Key ID (Kid) not matching any of the decryption keys' IDs. It introduces changes to handle SecurityTokenEncryptionKeyNotFoundException as a recoverable exception when the current configuration contains decryption keys.

Key changes include:

Updates to decryption logic to check for Kid matches.
Modifications to exception handling to treat specific decryption errors as recoverable.
Corrections and improvements in exception messages and log messages.-

Details:

Updated decryption code to throw SecurityTokenEncryptionKeyNotFoundException when decryption fails and token's Kid doesn't match the decryption keys' IDs.
- In certain scenarios decryption keys don't have key IDs. In this case
SecurityTokenEncryptionKeyNotFoundException is considered a recoverable exception when the current configuration contains decryption keys and in that case a metadata refresh will be triggered.

SecurityTokenEncryptionKeyNotFoundException already existed but it seems like it has never been used since it was created years ago and seems like the purpose was for this exact scenario.

github-actions · 2025-02-25T06:44:36Z

Summary


Generated on:	2/25/2025 - 6:44:35 AM
Coverage date:	2/25/2025 - 6:34:27 AM - 2/25/2025 - 6:44:11 AM
Parser:	MultiReport (60x Cobertura)
Assemblies:	1
Classes:	7
Files:	2
Line coverage:	80.3% (620 of 772)
Covered lines:	620
Uncovered lines:	152
Coverable lines:	772
Total lines:	483
Branch coverage:	67.8% (228 of 336)
Covered branches:	228
Total branches:	336
Method coverage:	Feature is only available for sponsors

Coverage

Microsoft.IdentityModel.JsonWebTokens - 80.3%

Name	Line	Branch
Microsoft.IdentityModel.JsonWebTokens	80.3%	67.8%
Microsoft.IdentityModel.JsonWebTokens.JwtTokenUtilities	100%
System.Text.RegularExpressions.Generated	80.3%	67.8%
System.Text.RegularExpressions.Generated	80.3%	67.8%
System.Text.RegularExpressions.Generated.<RegexGenerator_g>F12A1AEDDDFE32BA DF4DBFF323AF1BCB48B9F9721B7CD3E05F5E034CF225E3DF8__CreateJweRegex_1	79.2%	68%
System.Text.RegularExpressions.Generated.<RegexGenerator_g>F12A1AEDDDFE32BA DF4DBFF323AF1BCB48B9F9721B7CD3E05F5E034CF225E3DF8__CreateJwsRegex_0	81.4%	67.6%
System.Text.RegularExpressions.Generated.<RegexGenerator_g>F334844C618E00D3 CEC5D3FE0D00CF0141BBEE98635313BB2CB8D3921464CE05A__CreateJweRegex_1	79.2%	68%
System.Text.RegularExpressions.Generated.<RegexGenerator_g>F334844C618E00D3 CEC5D3FE0D00CF0141BBEE98635313BB2CB8D3921464CE05A__CreateJwsRegex_0	81.4%	67.6%

jennyf19

Re-setting my review, I need a bit more time to look at this.

src/Microsoft.IdentityModel.Tokens/TokenUtilities.cs

jmprieur

@pmaytak
You changed the public API, but didn't update the PublicApi.Unshipped.txt files (you didn't use the fixer in the IDE)

IDX10603 is not part of the declared API in LogMessages.cs.
IDX10907 is not part of the declared API in LogMessages.cs.
IsRecoverableException is not part of the declared API in TokenUtilities.cs.
IsRecoverableExceptionType is not part of the declared API in TokenUtilities.cs.

src/Microsoft.IdentityModel.Tokens/TokenUtilities.cs

github-actions · 2025-03-06T18:51:44Z

Summary


Generated on:	3/6/2025 - 6:51:43 PM
Coverage date:	3/6/2025 - 6:42:04 PM - 3/6/2025 - 6:51:15 PM
Parser:	MultiReport (60x Cobertura)
Assemblies:	1
Classes:	7
Files:	2
Line coverage:	80.3% (620 of 772)
Covered lines:	620
Uncovered lines:	152
Coverable lines:	772
Total lines:	483
Branch coverage:	67.8% (228 of 336)
Covered branches:	228
Total branches:	336
Method coverage:	Feature is only available for sponsors

Coverage

Microsoft.IdentityModel.JsonWebTokens - 80.3%

Name	Line	Branch
Microsoft.IdentityModel.JsonWebTokens	80.3%	67.8%
Microsoft.IdentityModel.JsonWebTokens.JwtTokenUtilities	100%
System.Text.RegularExpressions.Generated	80.3%	67.8%
System.Text.RegularExpressions.Generated	80.3%	67.8%
System.Text.RegularExpressions.Generated.<RegexGenerator_g>F12A1AEDDDFE32BA DF4DBFF323AF1BCB48B9F9721B7CD3E05F5E034CF225E3DF8__CreateJweRegex_1	79.2%	68%
System.Text.RegularExpressions.Generated.<RegexGenerator_g>F12A1AEDDDFE32BA DF4DBFF323AF1BCB48B9F9721B7CD3E05F5E034CF225E3DF8__CreateJwsRegex_0	81.4%	67.6%
System.Text.RegularExpressions.Generated.<RegexGenerator_g>F334844C618E00D3 CEC5D3FE0D00CF0141BBEE98635313BB2CB8D3921464CE05A__CreateJweRegex_1	79.2%	68%
System.Text.RegularExpressions.Generated.<RegexGenerator_g>F334844C618E00D3 CEC5D3FE0D00CF0141BBEE98635313BB2CB8D3921464CE05A__CreateJwsRegex_0	81.4%	67.6%

src/Microsoft.IdentityModel.Tokens/Validation/Results/Details/ValidationError.cs

github-actions · 2025-03-06T22:13:52Z

Summary


Generated on:	3/6/2025 - 10:13:51 PM
Coverage date:	3/6/2025 - 10:04:14 PM - 3/6/2025 - 10:13:25 PM
Parser:	MultiReport (60x Cobertura)
Assemblies:	1
Classes:	7
Files:	2
Line coverage:	80.3% (620 of 772)
Covered lines:	620
Uncovered lines:	152
Coverable lines:	772
Total lines:	483
Branch coverage:	67.8% (228 of 336)
Covered branches:	228
Total branches:	336
Method coverage:	Feature is only available for sponsors

Coverage

Microsoft.IdentityModel.JsonWebTokens - 80.3%

Name	Line	Branch
Microsoft.IdentityModel.JsonWebTokens	80.3%	67.8%
Microsoft.IdentityModel.JsonWebTokens.JwtTokenUtilities	100%
System.Text.RegularExpressions.Generated	80.3%	67.8%
System.Text.RegularExpressions.Generated	80.3%	67.8%
System.Text.RegularExpressions.Generated.<RegexGenerator_g>F12A1AEDDDFE32BA DF4DBFF323AF1BCB48B9F9721B7CD3E05F5E034CF225E3DF8__CreateJweRegex_1	79.2%	68%
System.Text.RegularExpressions.Generated.<RegexGenerator_g>F12A1AEDDDFE32BA DF4DBFF323AF1BCB48B9F9721B7CD3E05F5E034CF225E3DF8__CreateJwsRegex_0	81.4%	67.6%
System.Text.RegularExpressions.Generated.<RegexGenerator_g>F334844C618E00D3 CEC5D3FE0D00CF0141BBEE98635313BB2CB8D3921464CE05A__CreateJweRegex_1	79.2%	68%
System.Text.RegularExpressions.Generated.<RegexGenerator_g>F334844C618E00D3 CEC5D3FE0D00CF0141BBEE98635313BB2CB8D3921464CE05A__CreateJwsRegex_0	81.4%	67.6%

github-actions · 2025-03-06T22:14:48Z

Summary


Generated on:	3/6/2025 - 10:14:47 PM
Coverage date:	3/6/2025 - 10:05:39 PM - 3/6/2025 - 10:14:22 PM
Parser:	MultiReport (60x Cobertura)
Assemblies:	1
Classes:	7
Files:	2
Line coverage:	80.3% (620 of 772)
Covered lines:	620
Uncovered lines:	152
Coverable lines:	772
Total lines:	483
Branch coverage:	67.8% (228 of 336)
Covered branches:	228
Total branches:	336
Method coverage:	Feature is only available for sponsors

Coverage

Microsoft.IdentityModel.JsonWebTokens - 80.3%

Name	Line	Branch
Microsoft.IdentityModel.JsonWebTokens	80.3%	67.8%
Microsoft.IdentityModel.JsonWebTokens.JwtTokenUtilities	100%
System.Text.RegularExpressions.Generated	80.3%	67.8%
System.Text.RegularExpressions.Generated	80.3%	67.8%
System.Text.RegularExpressions.Generated.<RegexGenerator_g>F12A1AEDDDFE32BA DF4DBFF323AF1BCB48B9F9721B7CD3E05F5E034CF225E3DF8__CreateJweRegex_1	79.2%	68%
System.Text.RegularExpressions.Generated.<RegexGenerator_g>F12A1AEDDDFE32BA DF4DBFF323AF1BCB48B9F9721B7CD3E05F5E034CF225E3DF8__CreateJwsRegex_0	81.4%	67.6%
System.Text.RegularExpressions.Generated.<RegexGenerator_g>F334844C618E00D3 CEC5D3FE0D00CF0141BBEE98635313BB2CB8D3921464CE05A__CreateJweRegex_1	79.2%	68%
System.Text.RegularExpressions.Generated.<RegexGenerator_g>F334844C618E00D3 CEC5D3FE0D00CF0141BBEE98635313BB2CB8D3921464CE05A__CreateJwsRegex_0	81.4%	67.6%

github-actions · 2025-03-06T22:49:31Z

Summary


Generated on:	3/6/2025 - 10:49:30 PM
Coverage date:	3/6/2025 - 10:39:31 PM - 3/6/2025 - 10:49:03 PM
Parser:	MultiReport (60x Cobertura)
Assemblies:	1
Classes:	7
Files:	2
Line coverage:	80.3% (620 of 772)
Covered lines:	620
Uncovered lines:	152
Coverable lines:	772
Total lines:	483
Branch coverage:	67.8% (228 of 336)
Covered branches:	228
Total branches:	336
Method coverage:	Feature is only available for sponsors

Coverage

Microsoft.IdentityModel.JsonWebTokens - 80.3%

Name	Line	Branch
Microsoft.IdentityModel.JsonWebTokens	80.3%	67.8%
Microsoft.IdentityModel.JsonWebTokens.JwtTokenUtilities	100%
System.Text.RegularExpressions.Generated	80.3%	67.8%
System.Text.RegularExpressions.Generated	80.3%	67.8%
System.Text.RegularExpressions.Generated.<RegexGenerator_g>F12A1AEDDDFE32BA DF4DBFF323AF1BCB48B9F9721B7CD3E05F5E034CF225E3DF8__CreateJweRegex_1	79.2%	68%
System.Text.RegularExpressions.Generated.<RegexGenerator_g>F12A1AEDDDFE32BA DF4DBFF323AF1BCB48B9F9721B7CD3E05F5E034CF225E3DF8__CreateJwsRegex_0	81.4%	67.6%
System.Text.RegularExpressions.Generated.<RegexGenerator_g>F334844C618E00D3 CEC5D3FE0D00CF0141BBEE98635313BB2CB8D3921464CE05A__CreateJweRegex_1	79.2%	68%
System.Text.RegularExpressions.Generated.<RegexGenerator_g>F334844C618E00D3 CEC5D3FE0D00CF0141BBEE98635313BB2CB8D3921464CE05A__CreateJwsRegex_0	81.4%	67.6%

jmprieur

LGTM
Thanks @pmaytak. Great work!

Trigger metadata refresh for token decryption errors.

896f332

pmaytak requested a review from a team as a code owner February 25, 2025 06:31

jennyf19 approved these changes Feb 26, 2025

View reviewed changes

jennyf19 self-requested a review February 26, 2025 01:42

GeoK reviewed Feb 26, 2025

View reviewed changes

src/Microsoft.IdentityModel.Tokens/TokenUtilities.cs Outdated Show resolved Hide resolved

pmaytak added 2 commits March 3, 2025 00:09

Add unknown decrypt key error logic.

9bf3f67

Merge remote-tracking branch 'origin/dev' into pmaytak/lkg-decryption

be8e3a9

GeoK reviewed Mar 5, 2025

View reviewed changes

src/Microsoft.IdentityModel.Tokens/TokenUtilities.cs Outdated Show resolved Hide resolved

jmprieur reviewed Mar 6, 2025

View reviewed changes

src/Microsoft.IdentityModel.Tokens/TokenUtilities.cs Outdated Show resolved Hide resolved

pmaytak added 2 commits March 6, 2025 10:33

Merge remote-tracking branch 'origin/dev' into pmaytak/lkg-decryption

fb74714

Update APIs.

b895b52

pmaytak added 2 commits March 6, 2025 13:59

Undo the check for key ID match. Throw a general token decryption error.

7bf2fbe

Revert.

603b36d

GeoK reviewed Mar 6, 2025

View reviewed changes

src/Microsoft.IdentityModel.Tokens/Validation/Results/Details/ValidationError.cs Outdated Show resolved Hide resolved

Revert error type.

cae4dfa

GeoK approved these changes Mar 6, 2025

View reviewed changes

jmprieur approved these changes Mar 6, 2025

View reviewed changes

pmaytak merged commit 9c2016b into dev Mar 7, 2025
6 checks passed

pmaytak deleted the pmaytak/lkg-decryption branch March 7, 2025 00:14

pmaytak mentioned this pull request Mar 19, 2025

[Bug] Internal method, IsRecoverableExceptionType, signature was changed #3181

Closed

14 tasks

dependabot bot mentioned this pull request Sep 1, 2025

Bump Microsoft.AspNetCore.Authentication.JwtBearer and 7 others FSchiltz/Helse#249

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Trigger metadata refresh for token decryption errors #3149

Trigger metadata refresh for token decryption errors #3149

Uh oh!

pmaytak commented Feb 25, 2025 •

edited by jmprieur

Loading

Uh oh!

github-actions bot commented Feb 25, 2025

Uh oh!

jennyf19 left a comment •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

jmprieur left a comment

Uh oh!

Uh oh!

github-actions bot commented Mar 6, 2025

Uh oh!

Uh oh!

github-actions bot commented Mar 6, 2025

Uh oh!

github-actions bot commented Mar 6, 2025

Uh oh!

github-actions bot commented Mar 6, 2025

Uh oh!

jmprieur left a comment

Uh oh!

Uh oh!

Uh oh!

Trigger metadata refresh for token decryption errors #3149

Trigger metadata refresh for token decryption errors #3149

Uh oh!

Conversation

pmaytak commented Feb 25, 2025 • edited by jmprieur Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Details:

Uh oh!

github-actions bot commented Feb 25, 2025

Summary

Coverage

Uh oh!

jennyf19 left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

jmprieur left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions bot commented Mar 6, 2025

Summary

Coverage

Uh oh!

Uh oh!

github-actions bot commented Mar 6, 2025

Summary

Coverage

Uh oh!

github-actions bot commented Mar 6, 2025

Summary

Coverage

Uh oh!

github-actions bot commented Mar 6, 2025

Summary

Coverage

Uh oh!

jmprieur left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

pmaytak commented Feb 25, 2025 •

edited by jmprieur

Loading

jennyf19 left a comment •

edited

Loading