[Investigation] Can MSAL.NET leverage Identity Model extension for .NET / Crypto

[jmprieur]

Is your feature request related to a problem? Please describe.
we have many issues about some certs not being supported on some platforms (some versions of .NET FW, or .NET Core).
Identity Model extension for .NET / Crypto has solved the problem

Can we leverage it?
Is it supported on all the platforms where we need it?

Additional context
Add any other context or screenshots about the feature request here.

Workaround
Users can use the signed assertions ...

[bgavrilMS]

We met with @GeoK and discussed about this - this is a summary of the discussion.

Where can Identity Model be used in MSAL

1. Internally, in confidential client flows, MSAL needs to create and sign an assertion (a jwt) using an X509Certificate. Historically this has created lots of bugs because of the plethora of X509Certificate
   types out there. Identity Model knows about these details and is able to handle them across many platforms.

2. In the public API of MSAL, for confidential clients, we expose .WithCertificate(X509Certificate cert). With the integration of Identity Model we could also support: .WithCertificate(SigningCredentials creds). The top level abstraction SigniningCredentials is very powerful as there are adaptors to KeyVault, EC certs etc. Some discussion needs to happen here on the exact method signature, errors etc.

3. For PoP extensibility, to allow users to bring their own PoP key.

Changes needed for MSAL to reference Identity Model

There are 2 big rocks to consider in this transition:

1. Identity Model 5.x has a single non-System reference - Newtonsoft.Json. We cannot bring any dependnecies, especially not Newtonsoft, into the transitive dependency graph of MSAL.

Solution: Identity Model to ship a version 6 where they break this dependency. This is already planned, but no ETA.

2. Identity Model supports: net45, net451, net461 and netstandard1.4, netstandard2.0. This is incompatible with MSAL's netstandard1.3 target.

**Solution 1 **: MSAL to bump support of netstandard from 1.3 to (at least) 1.4 (I see no reason to not go to 1.6 - see table here)
This will require a major version upgrade of MSAL.

Solution 2: Identity Model to ship with netstandard 1.3 support in version 6

CC @henrik-me @brentschmaltz

[bgavrilMS]

I believe this concludes the investigation.

[henrik-me]

We should keep this as a goal and explore where things are as IdentityModel 6 ships.

[bgavrilMS]

I think we now generally agree that we will not do this.