Skip to content

[BUG] System.IdentityModel.Tokens.Jwt should be reverted to 7.1.2 #1617

Closed
@shan32423

Description

@shan32423

Describe the bug
Kubernetesclient is using retired legacy package System.IdentityModel.Tokens.Jwt from Microsoft. This package is no longer maintained by Microsoft. Microsoft recommends to use the Microsoft.IdentityModel.JsonWebTokens instead. Since this package is added as a direct dependency in Kubernetes client so it is messing the transitive dependencies in the application where Microsoft.AspNetCore.Authentication.JwtBearer is used as direct dependency. Because of 8.3.0, nuget is resolving transitive dependency System.IdentityModel.Tokens.Jwt with version 8.3.0. Would you please either revert this package to the old version i-e 7.1.2 or use the Microsoft.IdentityModel.JsonWebTokens or even safer to use the Microsoft.AspNetCore.Authentication.JwtBearer. Our application authentication is getting breaking and we cannot upgrade Kubernetesclient version to 16. There is bug in the latest version of System.IdentityModel.Tokens.Jwt and it won't be fixed since its a legacy package. You could see more details about this bug here, AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet#3114
Kubernetes C# SDK Client Version
e.g. 8.0.302

Server Kubernetes Version
e.g. 16

Dotnet Runtime Version
e.g. net6

To Reproduce
Microsoft.AspNetCore.Authentication.JwtBearer package resolves the System.IdentityModel.Tokens.Jwt package as dependency 7.1.2 but because of Kubernetesclient, it is being resolved as 8.3.0 and hence causing dependency mismatch. See the linked issue above.
Expected behavior
Kubernetesclient resolves the System.IdentityModel.Tokens.Jwt dependency as 7.1.2

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions