WebApi Updated to latest Microsoft.Owin.Security.* packages and cannot find IIssuerSecurityTokenProvider inteface

[vazans]

Hi, I was running properly on protecting the WebApi with AD B2C AuthBearer token, after I upgraded to latest packages of Microsoft.Owin.Security.* I cannot find the definition for IIssuerSecurityTokenProvider anymore but when I try to use IIssuerSecurityKeyProvider instead of IIssuerSecurityTokenProvider I am running into a whole host of other issues.
Can somebody point me in the correct direction? specifically how Do I get the Owin setup part with code samples using the latest packages.

[vazans]

@parakhj @phatcher , I see both of you have a similar issue, Do you have any fix for this - Thanks

[phatcher]

@vazans The Azure B2C team are not very communicative - the roadmap is updated very infrequently and they don't keep us informed of what's happening at all.

They are also not very responsive to change in my opinion, e.g. we've been waiting for over 18 months for on-behalf of flows and we still have to use ADAL 2 to talk to Graph API which is well behind the current versioning.

I'd suggest reverting to the earlier libraries

[vazans]

Thanks @phatcher, I will revert back, we also updated the .net framework so might be a rats nest there trying to revert back just these packages.
@parakhj if you are listening Please help us out here, updating packages and no documentation on new packages make it really hard for me to trust this offering.
I will KEEP this one OPEN until get an actual resolution.

[parakhj]

I had noticed @phatcher's comment and flagged it. I have been working to get some resources committed to improving our samples. If there is a list of issues that you would urgently want fixed, please let me know. I can get those prioritized first

[vazans]

@parakhj nice to see you addressing issues, what I need urgently should be very simple, In the samples give here what needs to change after all packages are moved latest and .net is 4.7

@parakhj Please answer these simple 2 steps and this will save a ton of time.
Environment: .net 4.7/Web API 2.1/All packages updated to latest stable versions.

1. In file startup.auth.cs, how do we register an app for ADB2C Auth? What needs to change below?
   Note: IIssuerSecurityTokenProvider not available anymore
   public void ConfigureAuth(IAppBuilder app)
   {
   TokenValidationParameters tvps = new TokenValidationParameters
   {
   // Accept only those tokens where the audience of the token is equal to the client ID of this app
   ValidAudience = ClientId,
   AuthenticationType = Startup.DefaultPolicy
   };

        app.UseOAuthBearerAuthentication(new OAuthBearerAuthenticationOptions
        {
            // This SecurityTokenProvider fetches the Azure AD B2C metadata & signing keys from the OpenIDConnect metadata endpoint
            AccessTokenFormat = new JwtFormat(tvps, new OpenIdConnectCachingSecurityTokenProvider(String.Format(AadInstance, Tenant, DefaultPolicy))) // This does not work
        });
    }
   

2. in file OpenIdConnectCachingSecurityTokenProvider.cs , how do we implement the replacement for IIssuerSecurityTokenProvider or other options

Thanks and marking this an URGENT Request,

[vazans]

I have put a detailed request of what I need above,
Can any one you help? @saraford @gsacavdm @microsoftopensource @rari2012 @spottedmahn @danieldobalian @parakhj - Reg How to use protect an .net WebApi 2.1(.net framework > 4.7) with AD B2C, The code shown in sample is outdated and does not work with latest packages, Please help.
I have given full details as comment above.

[spottedmahn]

Hi @vazans - I'm not sure exactly, sorry.

I do so this PR commit related to changing IIssuerSecurityKeyProvider.Tokens to IIssuerSecurityKeyProvider.SecurityKeys.

[spottedmahn]

Hi @vazans - I was able to get the TaskService updated. It compiles now but I haven't tested it yet.

The source code is here.

Apparently the package reference to Microsoft.IdentityModel.Protocol.Extensions is old. Source.

[spottedmahn]

Hi @vazans - I've updated the web app too. I've managed to test it and it appears to be working fine ⚡.

The branch with the changes is here.

[vazans]

Thanks @spottedmahn , will try this today and close when works.

[spottedmahn]

Cool @vazans. FYI, I submitted a cleaner PR #29 than the branch reference above.

[phatcher]

@spottedmahn @vazans I've managed to get my code working but my code uses the BootstrapContext to push the JWT token down to the API.

I noticed that there's a breaking change in that the identity's BoostrapContext is no longer a BootstrapContext but just the JWT token itself - is this intended or a bug in the Microsoft.Identity.Client code?