CryptographicException while calling /.well-known/openid-configuration (.NET 8) about identityserver HOT 14 CLOSED

@brockallen @AndersAbel 7.0.3-preview.1 works as expected in my setup, i. e. it works with .NET 8 and Load user profile: false.

Thanks!

from identityserver.

@AndersAbel: Yes, you are right. CryptographicException.HResult is -2147024894.

from identityserver.

Thanks for the detailed info @Tobias-08. A couple of questions:

• Are you using automatic key management with the UseX509Certificate enabled, or are you supplying an x509 cert as a manual signing key?
• Do you need to avoid loading the user profile/is this preventing you from upgrading while we investigate?

from identityserver.

@josephdecock Thanks for your response. Regarding your questions:

• We are using automatic key management with UseX509Certificate enabled (because we are using RSK's WS-Federation plugin which requires this).
• We are not in production yet so we are not blocked for the moment.

from identityserver.

This has been asked about before in another support channel. I think that you are right @Tobias-08 that there is a change in behaviour of the constructor. It looks like the exception type thrown has changed in .NET 8 so we might need to update our code to detect the new exception type.

from identityserver.

It looks like this is due to a changed behaviour from .NET 7 and up: dotnet/runtime@43c4405

Moving to IdentityServer repo to fix it.

from identityserver.

@brockallen @josephdecock The exception type was changed in .NET 7. So technically we should patch IdSrv 6.x. But end of life for .NET 7 is less than two months away. I think a fix for IdSrv 7.x is enough. What do you think?

from identityserver.

@Tobias-08 Do you think you could help me to get a value out of the exception thrown? I would need the value of CryptographicException.HResult. I assume that it should be 0x80070002 (= -2147024894), but I would like to verify before creating the patch.

from identityserver.

@Tobias-08 Thank you!

from identityserver.

@Tobias-08 If we merge this and put out a preview on Nuget, would you be able to help us test it?

@brockallen Could we merge this and put out another preview on 7.0.2 to get it tested in a proper environment? It's obviously not testable on a local development setup because the user profile is always available then.

from identityserver.

@AndersAbel Yes, of course.

from identityserver.

We're working on putting out a 7.0.3-preview.1 to test.

from identityserver.

We've pushed a 7.0.3-preview.1 to NuGet with the proposed fix. Please have a look and let us know how it works. Thanks.

from identityserver.

7.0.3 Has been pushed to NuGet. Thanks!

from identityserver.