Error loading System.IdentityModel.Tokens.Jwt dll in WebAPI2 project

Question

I am getting the below error in WebApi2 project:

Could not load file or assembly \'System.IdentityModel.Tokens.Jwt, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf

Answer 1

I ran into the exactly same troubles.

The reason is, that the latest versions of System.IdentityModel.Tokens.Jwt and System.IdentityModel.Tokens has some NuGet versions mishmash and they're not compatible with startup UseJwtBearerAuthentication method which requires System.IdentityModel v. 4.0.0.0.

If you're using nuget, you can be easily confused, because:

System.IdentityModel.Tokens is available in nuget just as pre-release 5.0.0.112 (nowdays)

System.IdentityModel.Tokens.Jwt latest version in nuget is available as pre-release version 5.0.0.112 OR 4.0.2.206221351 stable.

BUT, when you set JWT authentication in WebAPI

app.UseJwtBearerAuthentication(new JwtOptions());

System.IdentityModel version 4.0.0.0 is required.

The working solution for me is:

1) uninstall previously installed System.IdentityModel.Tokens nuget package

Uninstall-Package System.IdentityModel.Tokens

2) uninstall latest System.IdentityModel.Tokens.Jwt nuget package

Uninstall-Package System.IdentityModel.Tokens.Jwt

3) install System.IdentityModel.Tokens.Jwt version 4.0.2.206221351 (latest stable)

Install-Package System.IdentityModel.Tokens.Jwt -Version 4.0.2.206221351

4) add reference (not nuget!) to .NET framework assembly System.IdentityModel. Right click on project -> References -> Add reference -> Assemblies -> Framework -> select System.IdentityModel 4.0.0.0

Some steps may differ depending on what have you already installed/uninstalled.

Answer 2

In my case adding binding redirect helps.

I have a windows service application, which consumes Microsoft.Owin.Security.Jwt (3.0.1) and System.IdentityModel.Tokens.Jwt (4.0.20622.1351); As I can see, Microsoft.Owin.Security.Jwt (3.0.1) has reference to the System.IdentityModel.Tokens.Jwt (4.0.0) [katanaproject]:

<Reference Include="System.IdentityModel.Tokens.Jwt, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL">
  <SpecificVersion>False</SpecificVersion>
  <HintPath>..\..\packages\System.IdentityModel.Tokens.Jwt.4.0.0\lib\net45\System.IdentityModel.Tokens.Jwt.dll</HintPath>
</Reference>

The exception mentioned above has ocured exactly when the call was made:

app.UseJwtBearerAuthentication(new CustomJwtOptions());

So I can conclude that package Microsoft.Owin.Security.Jwt (3.0.1) tries to load System.IdentityModel.Tokens.Jwt (4.0.0)

EDIT

We have simple .net app, which is distributed with app.exe.config file. Modifying the file helps to solve the problem mentioned:

<?xml version="1.0" encoding="utf-8"?>
<configuration>
<!-- ... -->
<runtime>
    <!-- ... -->
    <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">
        <!-- ... -->
        <dependentAssembly>
            <assemblyIdentity name="System.IdentityModel.Tokens.Jwt" 
                              publicKeyToken="31bf3856ad364e35" 
                              culture="neutral" />
            <bindingRedirect oldVersion="0.0.0.0-4.0.20622.1351" 
                             newVersion="4.0.20622.1351" />
        </dependentAssembly>
        <!-- ... -->
    </assemblyBinding>
    <!-- ... -->
</runtime>
<!-- ... -->
</configuration>