Add TryAllDecryptionKeys flag to whether decrypt if no key IDs match

[pmaytak]

Fixes #3129

• Added a new property TryAllDecryptionKeys to TokenValidationParameters to indicate whether all decryption keys should be tried during token decryption when a key is not matched to the token 'kid' or if the token 'kid' is empty. This property defaults to true. [1] [2]
• Updated the GetContentEncryptionKeys and DecryptToken methods to use the new TryAllDecryptionKeys property for determining when to try all decryption keys. [1] [2]
• Also updates the new validation code path.

The precedence of decryption methods:

• TokenValidationParameters.TokenDecryptionKeyResolver, if set.
• TokenValidationParameters.TokenDecryptionKey, if set and key ID matches.
• TokenValidationParameters.TokenDecryptionKeys, if set and contains any keys where key ID matches.
• If TokenValidationParameters.TryAllDecryptionKeys is set to 'true', TokenValidationParameters.TokenDecryptionKey, TokenValidationParameters.TokenDecryptionKeys, and TokenDecryptionKeys from configuration.

Note: I will add more tests if this approach is agreed on.

Copilot reviewed 5 out of 8 changed files in this pull request and generated no comments.

Files not reviewed (3)

• src/Microsoft.IdentityModel.Tokens/PublicAPI.Unshipped.txt: Language not supported
• src/Microsoft.IdentityModel.Tokens/LogMessages.cs: Evaluated as low risk
• test/Microsoft.IdentityModel.JsonWebTokens.Tests/JsonWebTokenHandlerTests.cs: Evaluated as low risk

[jennyf19]

Any performance tests needed given the additional logic for key handling?

[pmaytak]

Any performance tests needed given the additional logic for key handling?

Don't think so. It's just one extra bool flag check.

[jmprieur]

LGTM
Thanks @pmaytak

There are formatting issues (IDE0055) that need to be addressed, probably in a different PRs (see at the bottom of the PR, as you have not touched that file)

[github-actions]

Summary

Summary

Generated on:	2/19/2025 - 11:14:26 AM
Coverage date:	2/19/2025 - 11:04:38 AM - 2/19/2025 - 11:14:01 AM
Parser:	MultiReport (60x Cobertura)
Assemblies:	1
Classes:	7
Files:	2
Line coverage:	80.3% (620 of 772)
Covered lines:	620
Uncovered lines:	152
Coverable lines:	772
Total lines:	483
Branch coverage:	67.8% (228 of 336)
Covered branches:	228
Total branches:	336
Method coverage:	Feature is only available for sponsors

Coverage

Microsoft.IdentityModel.JsonWebTokens - 80.3%

Name	Line	Branch
Microsoft.IdentityModel.JsonWebTokens	80.3%	67.8%
Microsoft.IdentityModel.JsonWebTokens.JwtTokenUtilities	100%
System.Text.RegularExpressions.Generated	80.3%	67.8%
System.Text.RegularExpressions.Generated	80.3%	67.8%
System.Text.RegularExpressions.Generated.<RegexGenerator_g>F12A1AEDDDFE32BA DF4DBFF323AF1BCB48B9F9721B7CD3E05F5E034CF225E3DF8__CreateJweRegex_1	79.2%	68%
System.Text.RegularExpressions.Generated.<RegexGenerator_g>F12A1AEDDDFE32BA DF4DBFF323AF1BCB48B9F9721B7CD3E05F5E034CF225E3DF8__CreateJwsRegex_0	81.4%	67.6%
System.Text.RegularExpressions.Generated.<RegexGenerator_g>F334844C618E00D3 CEC5D3FE0D00CF0141BBEE98635313BB2CB8D3921464CE05A__CreateJweRegex_1	79.2%	68%
System.Text.RegularExpressions.Generated.<RegexGenerator_g>F334844C618E00D3 CEC5D3FE0D00CF0141BBEE98635313BB2CB8D3921464CE05A__CreateJwsRegex_0	81.4%	67.6%