Got string ClaimType for JSON ClaimType

[taufikdev88]

Which version of Duende IdentityServer are you using?

Duende.IdentityModel version 7.0.8

Which version of .NET are you using?

9.0

Describe the bug

A JSON ClaimType identified as string ClaimType

To Reproduce

1. Request Access Token from Keycloak with claim with type "resource_access" or "realm_access"

Expected behavior

"resource_access" or "realm_access" claim with "JSON" ClaimType

Log output/exception with stacktrace

![Image](https://github.com/user-attachments/assets/77587216-c5b2-48d5-abd4-2e7512eda1d9)

Additional context

[taufikdev88]

{
  "exp" : 1732346131,
  "iat" : 1732342531,
  "auth_time" : 1732342530,
  "jti" : "314b625a-d51f-4a5d-94fe-e3fa86c40911",
  "iss" : "https://identity.harapan-jaya.com/realms/dev",
  "aud" : [ "images", "hjex-microservices", "account", "point" ],
  "sub" : "0f08f84b-9423-4fc2-bd05-4a28bed56b25",
  "typ" : "Bearer",
  "azp" : "hjex-retail",
  "sid" : "423668ee-bfc0-4ec3-aa2a-b50ed8d3054b",
  "acr" : "1",
  "resource_access" : {
    "images" : {
      "roles" : [ "user" ]
    },
    "hjex-microservices" : {
      "roles" : [ "Retail" ]
    },
    "account" : {
      "roles" : [ "manage-account", "manage-account-links", "delete-account", "view-profile" ]
    },
    "point" : {
      "roles" : [ "view-point" ]
    }
  },
  "scope" : "openid offline_access email profile",
  "email_verified" : true,
  "name" : "taufik Retail",
  "preferred_username" : "taufikdev88",
  "given_name" : "taufik",
  "locale" : "id",
  "family_name" : "Retail",
  "email" : "[email protected]",
  "client_id" : "hjex-retail",
  "username" : "taufikdev88",
  "token_type" : "Bearer",
  "active" : true
}

[taufikdev88]

Got claim type http://www.w3.org/2001/XMLSchema#string for "resource_access"

[taufikdev88]

I have created a pull request to foss project and IdentityModel project, please check it

Pull Request on foss
Pull Request on IdentityModel

[AndersAbel]

Why is the ClaimValueType important? How is it used? Why do you want to set it to "JSON"? That's not a constant value in the .NET ClaimValueTypes.

[taufikdev88]

I see how Microsoft create claim with "JSON" ClaimValueTypes from Microsoft.IdentityModel.Tokens.Jwt package
JwtPayload.cs
and from debugged code

I found that microsoft created 2 files with same content for JsonClaimValueTypes
System.IdentityModel.Tokens.Jwt
Microsoft.IdentityModel.JsonWebTokens

How do you prefer? How about create JsonClaimValueTypes inside the foss project?

I found interesting open-source project out there are trying to get claims from ClaimPrincipal with ClaimValueTypes specific to "JSON", where we can see in this project
AuthService

in some case developer need to combine multiple authentication scheme like I did, I use very great project from duende "IdentityModel.AspNetCore.OAuth2Introspection" which is now the project rebranded to Duende.IdentityModel

I think when all projects use standard definition for ClaimValueTypes, it will be great

[AndersAbel]

Yes, the System.IdentityModel.Tokens.Jwt package introduced the "JSON" ClaimValueType. They are moving that functionality to the Microsoft.IdentityModel.JsonWebTokens namespace, so even if there are two files they are essentially the same.

Using the "JSON" ClaimValueType is an extension. We are considering if we should do it too, but we would need to know why it is important to you. Do you have any code/functionality that relies on that value and treats the claim values differently if they are marked as "JSON" vs ClaimValueTypes.String?

[taufikdev88]

I have to ensure the claim type is JSON

[AndersAbel]

How is that code called? Do you convert the claim value string to something else based on the ClaimValueType?

[taufikdev88]

[AndersAbel]

I still don't understand how you use the ClaimValueType. Why does it matter to you? What functionality is dependent on the value being set to "JSON"?