Dictionary claims added to SecurityTokenDescriptor.Claims are no longer correctly serialized in 7.0.0-preview3

[kevinchalet]

Dictionaries (but it's likely other types of complex claims are impacted) are no longer correctly serialized in 7.0.0-preview3:

var dictionary = new Dictionary<string, string[]>
{
    ["prop1"] = new[] { "value1", "value2" }
};

var descriptor = new SecurityTokenDescriptor
{
    Claims = new Dictionary<string, object>
    {
        ["a"] = dictionary
    },

    SigningCredentials = new SigningCredentials(new RsaSecurityKey(RSA.Create(2048)), SecurityAlgorithms.RsaSha256)
};

var handler = new JsonWebTokenHandler();

var token = handler.CreateToken(descriptor);

7.0.0-preview:

{
  "a": {
    "prop1": [
      "value1",
      "value2"
    ]
  },
  "exp": 1692706803,
  "iat": 1692703203,
  "nbf": 1692703203
}

7.0.0-preview3

{
  "a": "System.Collections.Generic.Dictionary`2[System.String,System.String[]]",
  "exp": 1692706612,
  "iat": 1692703012,
  "nbf": 1692703012
}

Complex claims should be correctly serialized or an exception should be thrown, but using the CLR type name as the claim value in the generated token seems like a terrible choice.

/cc @brentschmaltz @jennyf19

[brentschmaltz]

@kevinchalet I expected this and am waiting to hear back about an api we wanted to use to see it if is compatible with AOT.

[jennyf19]

Included in preview4 release