Make CaseSensitiveClaimsIdentity.SecurityToken setter protected

src/Microsoft.IdentityModel.Tokens/CaseSensitiveClaimsIdentity.cs

@@ -19,7 +19,7 @@ public class CaseSensitiveClaimsIdentity : ClaimsIdentity
         /// Gets the <see cref="SecurityToken"/> associated with this claims identity.
         /// </summary>
         [field: NonSerialized]
-        public SecurityToken SecurityToken { get; internal set; }
+        public SecurityToken SecurityToken { get; protected internal set; }
 
         /// <summary>
         /// Initializes an instance of <see cref="CaseSensitiveClaimsIdentity"/>.

src/Microsoft.IdentityModel.Tokens/PublicAPI/net462/PublicAPI.Unshipped.txt

@@ -0,0 +1 @@
+~Microsoft.IdentityModel.Tokens.CaseSensitiveClaimsIdentity.SecurityToken.set -> void

src/Microsoft.IdentityModel.Tokens/PublicAPI/net472/PublicAPI.Unshipped.txt

@@ -0,0 +1 @@
+~Microsoft.IdentityModel.Tokens.CaseSensitiveClaimsIdentity.SecurityToken.set -> void

src/Microsoft.IdentityModel.Tokens/PublicAPI/net6.0/PublicAPI.Unshipped.txt

@@ -0,0 +1 @@
+~Microsoft.IdentityModel.Tokens.CaseSensitiveClaimsIdentity.SecurityToken.set -> void

src/Microsoft.IdentityModel.Tokens/PublicAPI/net8.0/PublicAPI.Unshipped.txt

@@ -0,0 +1 @@
+~Microsoft.IdentityModel.Tokens.CaseSensitiveClaimsIdentity.SecurityToken.set -> void

src/Microsoft.IdentityModel.Tokens/PublicAPI/net9.0/PublicAPI.Unshipped.txt

@@ -0,0 +1 @@
+~Microsoft.IdentityModel.Tokens.CaseSensitiveClaimsIdentity.SecurityToken.set -> void

src/Microsoft.IdentityModel.Tokens/PublicAPI/netstandard2.0/PublicAPI.Unshipped.txt

@@ -0,0 +1 @@
+~Microsoft.IdentityModel.Tokens.CaseSensitiveClaimsIdentity.SecurityToken.set -> void

test/Microsoft.IdentityModel.Tokens.Tests/CaseSensitiveClaimsIdentityTests.cs

@@ -3,6 +3,7 @@
 
 using System;
 using System.Collections.Generic;
+using System.IdentityModel.Tokens.Jwt;
 using System.IO;
 using System.Linq;
 using System.Security.Claims;
@@ -253,6 +254,15 @@ public void CaseSensitiveClaimsIdentity_IsSerializableTest()
             Assert.Equal(claimsIdentity.RoleClaimType, deserializedClaimsIdentity.RoleClaimType);
         }
 
+        [Fact]
+        public void CaseSensitiveClaimsIdentity_DerivedClassCanSetToken()
+        {
+            var jwt = new JwtSecurityToken();
+            CaseSensitiveClaimsIdentity claimsIdentity = new TestCaseSensitveClaimsIdentity(jwt);
+
+            Assert.Same(jwt, claimsIdentity.SecurityToken);
+        }
+
         public class CaseSensitiveClaimsIdentityTheoryData(string testId) : TheoryDataBase(testId)
         {
             internal ClaimsIdentity ClaimsIdentity { get; set; }
@@ -263,6 +273,14 @@ public class CaseSensitiveClaimsIdentityTheoryData(string testId) : TheoryDataBa
             internal List<string> ExpectedClaims { get; set; }
         }
 
+        public class TestCaseSensitveClaimsIdentity : CaseSensitiveClaimsIdentity
+        {
+            public TestCaseSensitveClaimsIdentity(SecurityToken token)
+            {
+                SecurityToken = token ?? throw new ArgumentNullException(nameof(token));
+            }
+        }
+
         private static ClaimsIdentity CreateCaseSensitiveClaimsIdentity(JObject claims, TokenValidationParameters validationParameters = null)
         {
             var handler = new JsonWebTokenHandler();