Support multiple issuers in JwtBearerConfigureOptions

[martincostello]

Is there an existing issue for this?

• I have searched the existing issues

Is your feature request related to a problem? Please describe the problem.

When configuring default bearer authentication options from configuration, only one valid issuer is supported.

aspnetcore/src/Security/Authentication/JwtBearer/src/JwtBearerConfigureOptions.cs

Lines 38 to 55 in d7d7deb

	var configSection = _authenticationConfigurationProvider.GetAuthenticationSchemeConfiguration(name);
	if (configSection is null || !configSection.GetChildren().Any())
	{
	return;
	}
	var issuer = configSection["ClaimsIssuer"];
	var audiences = configSection.GetSection("Audiences").GetChildren().Select(aud => aud.Value).ToArray();
	options.TokenValidationParameters = new()
	{
	ValidateIssuer = issuer is not null,
	ValidIssuers = new[] { issuer },
	ValidateAudience = audiences.Length > 0,
	ValidAudiences = audiences,
	ValidateIssuerSigningKey = true,
	IssuerSigningKey = GetIssuerSigningKey(_configuration, issuer),
	};

Describe the solution you'd like

The configuration schema should support the configuration of multiple valid issuers, like it does for audiences.

aspnetcore/src/Security/Authentication/JwtBearer/src/JwtBearerConfigureOptions.cs

Line 46 in d7d7deb

var audiences = configSection.GetSection("Audiences").GetChildren().Select(aud => aud.Value).ToArray();

Additional context

See #41956 (comment).

/cc @DamianEdwards

[ghost]

Thanks for contacting us.

We're moving this issue to the .NET 7 Planning milestone for future evaluation / consideration. We would like to keep this around to collect more feedback, which can help us with prioritizing this work. We will re-evaluate this issue, during our next planning meeting(s).
If we later determine, that the issue has no community involvement, or it's very rare and low-impact issue, we will close it - so that the team can focus on more important and high impact issues.
To learn more about what to expect next and how this issue will be handled you can read more about our triage process here.