JwtBearerOptions.Audience does not get populated from appsettings.json
- Dominant language
- C#
- Stars
- 38.4k
- Forks
- 10.9k
- Avg merge
- 2d 6h
- Merged PRs (30d)
- 290
Description
### Is there an existing issue for this?
- [x] I have searched the existing issues
### Describe the bug
I'm trying to simplify our auth config code as per minimal API examples, and stumbled upon this quirk: The framework doesn't automatically populate JwtBearerOptions.Audience from appsettings.json like most of the other properties.
I'm not 100% sure if this is by design, because there are also other properties of JwtBearerOptions (for example AutomaticRefreshInterval) that are not populated automatically from appsettings.json by [JwtBearerConfigureOptions.cs](https://github.com/dotnet/aspnetcore/blob/main/src/Security/Authentication/JwtBearer/src/JwtBearerConfigureOptions.cs) or [JwtBearerPostConfigureOptions.cs](https://github.com/dotnet/aspnetcore/blob/main/src/Security/Authentication/JwtBearer/src/JwtBearerPostConfigureOptions.cs), but it certainly was surprising behaviour to me. Then again, according to [a search](https://github.com/search?q=repo%3Adotnet%2Faspnetcore+path%3A%2F%5Esrc%5C%2FSecurity%5C%2FAuthentication%5C%2FJwtBearer%5C%2F%2F+.Audience&type=code) all this property is used for is to set TokenValidationParameters.ValidAudience, so it's not exactly a showstopper.
But it does lead to the weird situation that you can't get away with only using configuration keys belonging to the same type, i.e. only Authority+Audience from JwtBearerOptions due to the above issue, or only ValidIssuer+ValidAudience from TokenValidationParameters because JwtBearerOptions.MetadataAddress won't be populated automatically in this case. The only combination that works without extra or redundant config is JwtBearerOptions.Authority+TokenValidationParameters.ValidAudience (which is confusing enough to autistic individuals like myself to write an issue for it :P).
### Expected Behavior
JwtBearerOptions.Audience (and indeed all basic properties of JwtBearerOptions) should be possible to set from simplified authentication configuration as per https://learn.microsoft.com/en-us/aspnet/core/fundamentals/minimal-apis/security?view=aspnetcore-9.0#configuring-authentication-strategy
### Steps To Reproduce
```csharp
var builder = WebApplication.CreateBuilder();
builder.Configuration.AddInMemoryCollection(new Dictionary
{
["Authentication:DefaultScheme"] = "Bearer",
["Authentication:Schemes:Bearer:Authority"] = "https://example.com",
["Authentication:Schemes:Bearer:Audience"] = "example-audience",
});
builder.Services.AddAuthentication().AddJwtBearer();
var serviceProvider = builder.Services.BuildServiceProvider();
var jwtBearerOptions = serviceProvider.GetRequiredService>().Get(JwtBearerDefaults.AuthenticationScheme);
Assert.That(jwtBearerOptions.Authority, Is.EqualTo("https://example.com"));
Assert.That(jwtBearerOptions.Audience, Is.EqualTo("example-audience")); // Fails
Assert.That(jwtBearerOptions.MetadataAddress, Is.EqualTo("https://example.com/.well-known/openid-configuration"));
Assert.IsTrue(jwtBearerOptions.TokenValidationParameters.ValidateIssuer);
Assert.IsTrue(jwtBearerOptions.TokenValidationParameters.ValidateAudience);
```
### Exceptions (if any)
_No response_
### .NET Version
8.0 (but also all other versions as far as I can tell from code)
### Anything else?
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.