Error: IDX14100: JWT is not well formed, there are no dots (.). The token needs to be in JWS or JWE Compact Serialization Format. (JWS)

[psiservices-robswan]

IdentityServer version

7

.NET version

8

Description

We have an external provider that is using a very old version of IdentityServer. Everything was working until we upgraded to v7 of IdentityServer.
When we call their token endpoint it only returns the middle section of the jwt. Is there any way to accept only the claims?
Or is there a setting on older IdentityServers to send a full jwt?

Reproduction steps

No response

Expected behavior

No response

Logs

No response

Additional context

No response

[RolandGuijt]

Can you please let us know what version that IdentityServer has?

[psiservices-robswan]

I am asking. Is there a minimum version they need to be on for this to work?

[psiservices-robswan]

From our client: We are on IdentityServer3 (build 2.6.1.0)

[RolandGuijt]

IdentityServer3 returns complete JWTs and it's hard to make it return non-complete ones.

After upgrading, how did you come to the conclusion that their endpoint returns non-complete JWTs?
If its in the logs, can you please share those?
Can you please also share the configuration of the external identity provider?
What was the version of IdentityServer you upgraded from?

[AndersAbel]

This might be a stupid question, but just to check - could it be that you are accidentally using the userinfo endpoint on the IdentityServer3 and not the token endpoint? The User info endpoint returns JSON with the claims, but not in the form of a token.

[psiservices-robswan]

Is it possible to get this error if the token is invalid? Like it fails the validator?
I believe the SecurityTokenValidator was overridden to skip validation for this client

[psiservices-robswan]

OK, I've made some headway and now the error I get is IDX11020: The JSON value of type: 'StartArray', could not be converted to 'JsonTokenType.String or JsonTokenType.Number'. Reading: 'System.IdentityModel.Tokens.Jwt.JwtPayload.sub'
The client sends an array as the sub claim.
I don't suppose there is any work around for that?

[RolandGuijt]

Can you please somehow intercept the token and post a (redacted) version of it here?

[psiservices-robswan]

{
"iss": "https://xxx.xxx.xxx",
"aud": "3a020061843649fa8f6f5b5d6988dde4",
"exp": 1741808970,
"nbf": 1741808670,
"iat": 1741808670,
"sid": "1e35e785c625586b04a264138f10169d",
"sub": [
"user-id",
"username"
],
"auth_time": 1741806485,
"idp": "idsrv",
"id": "user-id",
"name": "First Name Last Name",
"family_name": "Last Name",
"given_name": "First Name",
"amr": [
"password"
]
}

[RolandGuijt]

IdentityServer 3 out of the box didn't return the sub as an array. So it must have been customized.
Since you are using that Identity Server instance as an upstream provider which is configured using a Microsoft handler the error you're seeing is coming from Microsoft's code that doesn't support the array.
Could it be the case that you had a customization for the handler before the upgrade that now isn't present in the new version?

[psiservices-robswan]

I do not believe so. The only change is upgrading Duende IdentityServer from 6.3.3 to 7.1.1

[RolandGuijt]

When you upgraded IdentityServer you also upgraded Microsoft's System.IdentityModel.* dependencies and maybe you even upgraded the .NET version as well. There are many nuances in these new versions that could cause this changed behavior.
Unfortunately it will take more than a chat in this discussion forum to get to the bottom of this. But we can help you via our consultancy services. Please contact us for details.

[psiservices-robswan]

OK, thanks - I will take that as there isn't a quick workaround and tell our client to fix their stuff.
please close this discussion