Make CaseSensitiveClaimIdentity serializable (#2850)

* make CaseSensitiveClaimsIdentity serializable (and also have to make SecurityToken serializable)

* add unit test

src/Microsoft.IdentityModel.Tokens/CaseSensitiveClaimsIdentity.cs

@@ -12,6 +12,7 @@ namespace Microsoft.IdentityModel.Tokens
     /// <summary>
     /// A derived <see cref="ClaimsIdentity"/> where claim retrieval is case-sensitive. The current <see cref="ClaimsIdentity"/> retrieves claims in a case-insensitive manner which is different than querying the underlying <see cref="SecurityToken"/>. The <see cref="CaseSensitiveClaimsIdentity"/> provides consistent retrieval logic between the <see cref="SecurityToken"/> and <see cref="ClaimsIdentity"/>.
     /// </summary>
+    [Serializable]
     public class CaseSensitiveClaimsIdentity : ClaimsIdentity
     {
         /// <summary>

src/Microsoft.IdentityModel.Tokens/SecurityToken.cs

@@ -11,6 +11,7 @@ namespace Microsoft.IdentityModel.Tokens
     /// <summary>
     /// Base class for security token.
     /// </summary>
+    [Serializable]
     public abstract class SecurityToken : ISafeLogSecurityArtifact
     {
         internal virtual IEnumerable<Claim> CreateClaims(string issuer)

test/Microsoft.IdentityModel.Tokens.Tests/CaseSensitiveClaimsIdentityTests.cs

@@ -1,10 +1,13 @@
-// Copyright (c) Microsoft Corporation.
+// Copyright (c) Microsoft Corporation. All rights reserved.
 // Licensed under the MIT License.
 
 using System;
 using System.Collections.Generic;
+using System.IO;
 using System.Linq;
 using System.Security.Claims;
+using System.Text.Json;
+using System.Text.Json.Serialization;
 using Microsoft.IdentityModel.JsonWebTokens;
 using Microsoft.IdentityModel.TestUtils;
 using Newtonsoft.Json.Linq;
@@ -214,6 +217,33 @@ public static TheoryData<CaseSensitiveClaimsIdentityTheoryData> GetCaseSensitive
             }
         }
 
+        [Fact]
+        public void CaseSensitiveClaimsIdentity_IsSerializableTest()
+        {
+            // arrange
+            CaseSensitiveClaimsIdentity claimsIdentity = (CaseSensitiveClaimsIdentity)CreateCaseSensitiveClaimsIdentity(new JObject
+            {
+                [UpperCaseClaimName] = LowerCaseClaimValue,
+            });
+            CaseSensitiveClaimsIdentity deserializedClaimsIdentity;
+
+            // act
+            var memoryStream = new MemoryStream();
+            var serializerOptions = new JsonSerializerOptions()
+            {
+                ReferenceHandler = ReferenceHandler.IgnoreCycles
+            };
+
+            JsonSerializer.Serialize(memoryStream, claimsIdentity, typeof(CaseSensitiveClaimsIdentity), serializerOptions);
+            memoryStream.Seek(0, SeekOrigin.Begin);
+            deserializedClaimsIdentity = (CaseSensitiveClaimsIdentity)JsonSerializer.Deserialize(memoryStream, typeof(CaseSensitiveClaimsIdentity), serializerOptions);
+
+            // assert
+            Assert.NotNull(deserializedClaimsIdentity);
+            Assert.Equal(claimsIdentity.NameClaimType, deserializedClaimsIdentity.NameClaimType);
+            Assert.Equal(claimsIdentity.RoleClaimType, deserializedClaimsIdentity.RoleClaimType);
+        }
+
         public class CaseSensitiveClaimsIdentityTheoryData(string testId) : TheoryDataBase(testId)
         {
             internal ClaimsIdentity ClaimsIdentity { get; set; }