Fix JwtSecurityToken Missing Mapping When Creating a Token.

src/Microsoft.IdentityModel.Tokens/X509EncryptingCredentials.cs

@@ -11,6 +11,8 @@ namespace Microsoft.IdentityModel.Tokens
     /// </summary>
     public class X509EncryptingCredentials : EncryptingCredentials
     {
+        internal const string _useShortNameForRsaOaepKey = "Switch.Microsoft.IdentityModel.UseShortNameForRsaOaepKey";
+
         /// <summary>
         /// Designed to construct <see cref="EncryptingCredentials"/> based on a x509 certificate.
         /// </summary>
@@ -21,7 +23,7 @@ public class X509EncryptingCredentials : EncryptingCredentials
         /// </remarks>
         /// <exception cref="ArgumentNullException">if 'certificate' is null.</exception>
         public X509EncryptingCredentials(X509Certificate2 certificate)
-            : this(certificate, SecurityAlgorithms.DefaultAsymmetricKeyWrapAlgorithm, SecurityAlgorithms.DefaultSymmetricEncryptionAlgorithm)
+            : this(certificate, ShouldUseShortNameForRsaOaepKey() ? SecurityAlgorithms.RsaOAEP : SecurityAlgorithms.DefaultAsymmetricKeyWrapAlgorithm, SecurityAlgorithms.DefaultSymmetricEncryptionAlgorithm)
         {
         }
 
@@ -48,5 +50,10 @@ public X509Certificate2 Certificate
             get;
             private set;
         }
+
+        private static bool ShouldUseShortNameForRsaOaepKey()
+        {
+            return AppContext.TryGetSwitch("Switch.Microsoft.IdentityModel.UseShortNameForRsaOaepKey", out var useKeyWrap) && useKeyWrap;
+        }
     }
 }

src/System.IdentityModel.Tokens.Jwt/JwtSecurityTokenHandler.cs

@@ -35,7 +35,7 @@ public class JwtSecurityTokenHandler : SecurityTokenHandler
         private Dictionary<string, string> _outboundAlgorithmMap = null;
         private static string _shortClaimType = _namespace + "/ShortTypeName";
         private bool _mapInboundClaims = DefaultMapInboundClaims;
-
+       
         /// <summary>
         /// Default claim type mapping for inbound claims.
         /// </summary>

test/System.IdentityModel.Tokens.Jwt.Tests/JwtSecurityTokenHandlerNonParallelRunTests.cs

@@ -0,0 +1,9 @@
+using Xunit;
+
+namespace System.IdentityModel.Tokens.Jwt.Tests
+{
+    [CollectionDefinition(nameof(JwtSecurityTokenHandlerNonParallelRunTests), DisableParallelization = true)]
+    public class JwtSecurityTokenHandlerNonParallelRunTests
+    {
+    }
+}

test/System.IdentityModel.Tokens.Jwt.Tests/JwtSecurityTokenHandlerTests.WithContextSwitches.cs

@@ -0,0 +1,115 @@
+using System.Security.Claims;
+using Microsoft.IdentityModel.JsonWebTokens;
+using Microsoft.IdentityModel.TestUtils;
+using Microsoft.IdentityModel.Tokens;
+using Xunit;
+
+namespace System.IdentityModel.Tokens.Jwt.Tests
+{
+    [Collection(nameof(JwtSecurityTokenHandlerNonParallelRunTests))]
+    public class JwtSecurityTokenHandlerTestsWithContextSwitches
+    {
+        [Fact]
+
+        public void JwtSecurityTokenHandler_CreateToken_AddShortFormMappingForRsaOAEPEnabled()
+        {
+            AppContext.SetSwitch(X509EncryptingCredentials._useShortNameForRsaOaepKey, true);
+            var encryptingCredentials = new X509EncryptingCredentials(Default.Certificate);
+            SecurityTokenDescriptor tokenDescriptor = new SecurityTokenDescriptor
+            {
+                Issuer = Default.Issuer,
+                IssuedAt = DateTime.UtcNow.Subtract(new TimeSpan(1, 0, 0)),
+                Subject = new ClaimsIdentity(Default.PayloadJsonClaims),
+                NotBefore = DateTime.UtcNow.Subtract(new TimeSpan(1, 0, 0)),
+                Expires = DateTime.UtcNow.Subtract(new TimeSpan(0, 10, 0)),
+                SigningCredentials = Default.AsymmetricSigningCredentials,
+                EncryptingCredentials = encryptingCredentials,
+                TokenType = "JWE"
+            };
+
+            JwtSecurityTokenHandler tokenHandler = new JwtSecurityTokenHandler();
+            JwtSecurityToken token = tokenHandler.CreateJwtSecurityToken(tokenDescriptor);
+
+            Assert.NotNull(token);
+            Assert.NotEqual(token.Header.Alg, SecurityAlgorithms.RsaOaepKeyWrap);
+            Assert.Equal(token.Header.Alg, SecurityAlgorithms.RsaOAEP);
+        }
+
+        [Fact]
+        public void JwtSecurityTokenHandler_CreateToken_AddShortFormMappingForRsaOAEPDisabled()
+        {
+            AppContext.SetSwitch(X509EncryptingCredentials._useShortNameForRsaOaepKey, false);
+            var encryptingCredentials = new X509EncryptingCredentials(Default.Certificate);
+            SecurityTokenDescriptor tokenDescriptor = new SecurityTokenDescriptor
+            {
+                Issuer = Default.Issuer,
+                IssuedAt = DateTime.UtcNow.Subtract(new TimeSpan(1, 0, 0)),
+                Subject = new ClaimsIdentity(Default.PayloadJsonClaims),
+                NotBefore = DateTime.UtcNow.Subtract(new TimeSpan(1, 0, 0)),
+                Expires = DateTime.UtcNow.Subtract(new TimeSpan(0, 10, 0)),
+                SigningCredentials = Default.AsymmetricSigningCredentials,
+                EncryptingCredentials = encryptingCredentials,
+                TokenType = "JWE"
+            };
+
+            JwtSecurityTokenHandler tokenHandler = new JwtSecurityTokenHandler();
+            JwtSecurityToken token = tokenHandler.CreateJwtSecurityToken(tokenDescriptor);
+
+            Assert.NotNull(token);
+            Assert.NotEqual(token.Header.Alg, SecurityAlgorithms.RsaOAEP);
+            Assert.Equal(token.Header.Alg, SecurityAlgorithms.RsaOaepKeyWrap);
+        }
+
+        [Fact]
+        public void JsonWebTokenHandler_CreateToken_AddShortFormMappingForRsaOAEPEnabled()
+        {
+            AppContext.SetSwitch(X509EncryptingCredentials._useShortNameForRsaOaepKey, true);
+            var encryptingCredentials = new X509EncryptingCredentials(Default.Certificate);
+            SecurityTokenDescriptor tokenDescriptor = new SecurityTokenDescriptor
+            {
+                Issuer = Default.Issuer,
+                IssuedAt = DateTime.UtcNow.Subtract(new TimeSpan(1, 0, 0)),
+                Subject = new ClaimsIdentity(Default.PayloadJsonClaims),
+                NotBefore = DateTime.UtcNow.Subtract(new TimeSpan(1, 0, 0)),
+                Expires = DateTime.UtcNow.Subtract(new TimeSpan(0, 10, 0)),
+                SigningCredentials = Default.AsymmetricSigningCredentials,
+                EncryptingCredentials = encryptingCredentials,
+                TokenType = "JWE"
+            };
+
+            JsonWebTokenHandler tokenHandler = new JsonWebTokenHandler();
+            var token = tokenHandler.CreateToken(tokenDescriptor);
+            JsonWebToken jsonToken = tokenHandler.ReadToken(token) as JsonWebToken;
+
+            Assert.NotNull(jsonToken);
+            Assert.NotEqual(jsonToken._alg, SecurityAlgorithms.RsaOaepKeyWrap);
+            Assert.Equal(jsonToken._alg, SecurityAlgorithms.RsaOAEP);
+        }
+
+        [Fact]
+        public void JsonWebTokenHandler_CreateToken_AddShortFormMappingForRsaOAEPDisabled()
+        {
+            AppContext.SetSwitch(X509EncryptingCredentials._useShortNameForRsaOaepKey, false);
+            var encryptingCredentials = new X509EncryptingCredentials(Default.Certificate);
+            SecurityTokenDescriptor tokenDescriptor = new SecurityTokenDescriptor
+            {
+                Issuer = Default.Issuer,
+                IssuedAt = DateTime.UtcNow.Subtract(new TimeSpan(1, 0, 0)),
+                Subject = new ClaimsIdentity(Default.PayloadJsonClaims),
+                NotBefore = DateTime.UtcNow.Subtract(new TimeSpan(1, 0, 0)),
+                Expires = DateTime.UtcNow.Subtract(new TimeSpan(0, 10, 0)),
+                SigningCredentials = Default.AsymmetricSigningCredentials,
+                EncryptingCredentials = encryptingCredentials,
+                TokenType = "JWE"
+            };
+
+            JsonWebTokenHandler tokenHandler = new JsonWebTokenHandler();
+            var token = tokenHandler.CreateToken(tokenDescriptor);
+            JsonWebToken jsonToken = tokenHandler.ReadToken(token) as JsonWebToken;
+
+            Assert.NotNull(jsonToken);
+            Assert.Equal(jsonToken._alg, SecurityAlgorithms.RsaOaepKeyWrap);
+            Assert.NotEqual(jsonToken._alg, SecurityAlgorithms.RsaOAEP);
+        }
+    }
+}