dotnet / dotnet/aspnetcore

JwtBearerOptions.Audience does not get populated from appsettings.json

Open
#59,790 2 comments 0 reactions 1 assignee Claimed by @halter73 View on GitHub
area-auth enhancement
Dominant language
C#
Stars
38.4k
Forks
10.9k
Avg merge
2d 6h
Merged PRs (30d)
290

Description

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Describe the bug

I'm trying to simplify our auth config code as per minimal API examples, and stumbled upon this quirk: The framework doesn't automatically populate JwtBearerOptions.Audience from appsettings.json like most of the other properties.

I'm not 100% sure if this is by design, because there are also other properties of JwtBearerOptions (for example AutomaticRefreshInterval) that are not populated automatically from appsettings.json by [JwtBearerConfigureOptions.cs](https://github.com/dotnet/aspnetcore/blob/main/src/Security/Authentication/JwtBearer/src/JwtBearerConfigureOptions.cs) or [JwtBearerPostConfigureOptions.cs](https://github.com/dotnet/aspnetcore/blob/main/src/Security/Authentication/JwtBearer/src/JwtBearerPostConfigureOptions.cs), but it certainly was surprising behaviour to me. Then again, according to [a search](https://github.com/search?q=repo%3Adotnet%2Faspnetcore+path%3A%2F%5Esrc%5C%2FSecurity%5C%2FAuthentication%5C%2FJwtBearer%5C%2F%2F+.Audience&type=code) all this property is used for is to set TokenValidationParameters.ValidAudience, so it's not exactly a showstopper.

But it does lead to the weird situation that you can't get away with only using configuration keys belonging to the same type, i.e. only Authority+Audience from JwtBearerOptions due to the above issue, or only ValidIssuer+ValidAudience from TokenValidationParameters because JwtBearerOptions.MetadataAddress won't be populated automatically in this case. The only combination that works without extra or redundant config is JwtBearerOptions.Authority+TokenValidationParameters.ValidAudience (which is confusing enough to autistic individuals like myself to write an issue for it :P).

### Expected Behavior

JwtBearerOptions.Audience (and indeed all basic properties of JwtBearerOptions) should be possible to set from simplified authentication configuration as per https://learn.microsoft.com/en-us/aspnet/core/fundamentals/minimal-apis/security?view=aspnetcore-9.0#configuring-authentication-strategy

### Steps To Reproduce

```csharp
var builder = WebApplication.CreateBuilder();
builder.Configuration.AddInMemoryCollection(new Dictionary
{
["Authentication:DefaultScheme"] = "Bearer",
["Authentication:Schemes:Bearer:Authority"] = "https://example.com",
["Authentication:Schemes:Bearer:Audience"] = "example-audience",
});

builder.Services.AddAuthentication().AddJwtBearer();
var serviceProvider = builder.Services.BuildServiceProvider();

var jwtBearerOptions = serviceProvider.GetRequiredService>().Get(JwtBearerDefaults.AuthenticationScheme);
Assert.That(jwtBearerOptions.Authority, Is.EqualTo("https://example.com"));
Assert.That(jwtBearerOptions.Audience, Is.EqualTo("example-audience")); // Fails
Assert.That(jwtBearerOptions.MetadataAddress, Is.EqualTo("https://example.com/.well-known/openid-configuration"));
Assert.IsTrue(jwtBearerOptions.TokenValidationParameters.ValidateIssuer);
Assert.IsTrue(jwtBearerOptions.TokenValidationParameters.ValidateAudience);
```

### Exceptions (if any)

_No response_

### .NET Version

8.0 (but also all other versions as far as I can tell from code)

### Anything else?

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.