[Bug] Unhelpful error message with missing dependency for System.Buffers

[ThreeSevenths]

Which version of Microsoft.IdentityModel are you using?
Microsoft.IdentityModel.JsonWebTokens 6.29.0

Where is the issue?

• M.IM.JsonWebTokens
• M.IM.KeyVaultExtensions
• M.IM.Logging
• M.IM.ManagedKeyVaultSecurityKey
• M.IM.Protocols
• M.IM.Protocols.OpenIdConnect
• M.IM.Protocols.SignedHttpRequest
• M.IM.Protocols.WsFederation
• M.IM.TestExtensions
• M.IM.Tokens
• M.IM.Tokens.Saml
• M.IM.Validators
• M.IM.Xml
• S.IM.Tokens.Jwt
• Other (please describe)

Is this a new or an existing app?
a. The app is in production and I have upgraded to a new version of Microsoft.IdentityModel.JsonWebTokens

Repro

Create a console net4.8 project. Add a package reference to Microsoft.IdentityModel.JsonWebTokens. Add a simple handler to validate a token, similar to this below.

var handler = new Microsoft.IdentityModel.JsonWebTokens.JsonWebTokenHandler();
var tvp = new TokenValidationParameters();
var result = handler.ValidateToken(token, tvp);

Everything works. Now, remove the System.Buffers.dll from the output directory, simulating the missing dependency. This was my mistake, and I freely admit it.

Expected behavior
I expect that the ValidateToken fails, and in the exception chain, the Assembly missing error is noted. This happens if you ReadToken() instead, which will throw with IDX14102 and the inner exception is the missing dependency.

Actual behavior
ValidateToken() returns with IsValid=false and an un-thrown exception 'IDX14100: JWT is not well formed: {Token or PII warning}, there are no dots (.).' There is no inner exception that the dependency is missing.

Possible solution
This might be down to how the exception handling on the inner ReadToken() is handled.

Additional context / logs / screenshots / links to code

I understand that this is not going to be a common problem that developers are going to hit. I am hoping that we can enhance the exception so that the issue would be more easy to identify in the future.

Thank you for all the work you do to make this library.

[brentschmaltz]

@ThreeSevenths thanks for reporting, anything that will make the product better we will fix when time allows.

[halter73]

dotnet/aspnetcore#52388 shows another example where 'IDX14100: JWT is not well formed: {Token or PII warning}, there are no dots (.).' was a poor error message. The real issue was that the "iat" claim was invalid, but the token did have "dots (.)."

info: Microsoft.AspNetCore.Authentication.JwtBearer.JwtBearerHandler[1]
      Failed to validate the token.
      Microsoft.IdentityModel.Tokens.SecurityTokenMalformedException: IDX14100: JWT is not well formed, there are no dots (.).
The token needs to be in JWS or JWE Compact Serialization Format. (JWS): 'EncodedHeader.EndcodedPayload.EncodedSignature'. (JWE): 'EncodedProtectedHeader.EncodedEncryptedKey.EncodedInitializationVector.EncodedCiphertext.EncodedAuthenticationTag'.
       ---> System.ArgumentException: IDX14101: Unable to decode the payload '[PII of type 'Microsoft.IdentityModel.Logging.SecurityArtifact' is hidden. For more details, see https://aka.ms/IdentityModel/PII.]' as Base64Url encoded string.
       ---> System.Text.Json.JsonException: IDX11020: The JSON value of type: 'String', could not be converted to 'JsonTokenType.Number'. Reading: 'Microsoft.IdentityModel.JsonWebTokens.JsonWebToken.iat', Position: '52', CurrentDepth: '1', BytesConsumed: '75'.
         at Microsoft.IdentityModel.Tokens.Json.JsonSerializerPrimitives.ReadLong(Utf8JsonReader& reader, String propertyName, String className, Boolean read)
         at Microsoft.IdentityModel.JsonWebTokens.JsonWebToken.CreatePayloadClaimSet(Byte[] bytes, Int32 length)
         at Microsoft.IdentityModel.Tokens.Base64UrlEncoding.Decode[T](String input, Int32 offset, Int32 length, Func`3 action)
         at Microsoft.IdentityModel.JsonWebTokens.JsonWebToken.CreateClaimSet(String rawString, Int32 startIndex, Int32 length, Func`3 action)
         at Microsoft.IdentityModel.JsonWebTokens.JsonWebToken.ReadToken(String encodedJson)
         --- End of inner exception stack trace ---
         at Microsoft.IdentityModel.JsonWebTokens.JsonWebToken.ReadToken(String encodedJson)
         at Microsoft.IdentityModel.JsonWebTokens.JsonWebToken..ctor(String jwtEncodedString)
         at Microsoft.IdentityModel.JsonWebTokens.JsonWebTokenHandler.ReadToken(String token, TokenValidationParameters validationParameters)
         --- End of inner exception stack trace ---