[Feature Request] Enable NativeAOT support for validating Json Web Tokens in ASP.NET

[eerhardt]

Is your feature request related to a problem? Please describe.
In .NET 8 our goal is to enable a subset of ASP.NET functionality to support publishing with NativeAOT. For more information on this goal, see Support publishing ASP.NET Core API apps with Native AOT.

One of the scenarios we are targeting is for an application to expose an HTTP API endpoint that is secured with JWT auth.
For example, an app like the following:

using System.Security.Claims;

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddAuthentication("Bearer").AddJwtBearer();
builder.Services.AddAuthorization();

var app = builder.Build();

app.MapGet("/", () => "Hello, World!");
app.MapGet("/secret", (ClaimsPrincipal user) => $"Hello {user.Identity?.Name}. My secret")
    .RequireAuthorization();

app.Run();

In order to make NativeAOT work in this application, we will need to make the JWT token validation library work with NativeAOT. See https://learn.microsoft.com/dotnet/core/deploying/native-aot/ for information on NativeAOT.

In short, we will need to address any NativeAOT and trimming warnings coming from the Microsoft.IdentityModel.* libraries when publishing an ASP.NET app for NativeAOT. Current known warnings are stemming from:

• LogHelper.LogExceptionImpl (should be an easy fix) First Round of Trimming Analysis #2042
• Microsoft.IdentityModel.Json, the internal fork of Newtonsoft (which is not AOT compatible). We will need to update all places that ASP.NET token validation code calls to use System.Text.Json instead, which can be AOT compatible.

Describe the solution you'd like
I am able to publish the above ASP.NET application for NativeAOT with no warnings. The app works successfully. The app's RPS is within 5% of the same application published normally. And then app size on disk isn't bloated due to unnecessary/unused code being generated.

Describe alternatives you've considered
N/A

Additional context
N/A

[brentschmaltz]

@eerhardt we will also need #2032 and have asp.net use JsonWebTokenHandler then we do not have to include JwtSecurityTokenHandler (another assembly).

[brentschmaltz]

7.x is compatible with AOT