Trigger metadata refresh for token decryption errors

[pmaytak]

Fixes #3148

This pull request includes several changes to improve the handling of token decryption errors and enhance the test cases for token validation. The most important changes include modifications to the IsRecoverableException and IsRecoverableExceptionType methods, updates to the test cases for token decryption, and the addition of new test cases to handle retry logic for token decryption.

Enhancements to token decryption error handling:

• src/Microsoft.IdentityModel.Tokens/TokenUtilities.cs: Added SecurityTokenDecryptionFailedException to the list of recoverable exceptions in both IsRecoverableException and IsRecoverableExceptionType methods. [1] [2]

Updates to test cases for token decryption:

• test/Microsoft.IdentityModel.JsonWebTokens.Tests/JsonWebTokenHandler.ValidateTokenAsyncTests.Decryption.cs: Refactored ValidateTokenAsyncDecryptionTheoryData to include a new test case JWE_TokenDecryptError_SuccessOnRetry, which tests the retry logic for token decryption errors. [1] [2] [3] [4]

Addition of new test cases:

• test/Microsoft.IdentityModel.JsonWebTokens.Tests/JsonWebTokenHandlerTests.cs: Added a new test case JWE_TokenDecryptError_SuccessOnRetry to ValidateJweTestCases to validate the retry logic for token decryption errors using a configuration manager. [1] [2]

[github-actions]

Summary

Summary

Generated on:	2/25/2025 - 6:44:35 AM
Coverage date:	2/25/2025 - 6:34:27 AM - 2/25/2025 - 6:44:11 AM
Parser:	MultiReport (60x Cobertura)
Assemblies:	1
Classes:	7
Files:	2
Line coverage:	80.3% (620 of 772)
Covered lines:	620
Uncovered lines:	152
Coverable lines:	772
Total lines:	483
Branch coverage:	67.8% (228 of 336)
Covered branches:	228
Total branches:	336
Method coverage:	Feature is only available for sponsors

Coverage

Microsoft.IdentityModel.JsonWebTokens - 80.3%

Name	Line	Branch
Microsoft.IdentityModel.JsonWebTokens	80.3%	67.8%
Microsoft.IdentityModel.JsonWebTokens.JwtTokenUtilities	100%
System.Text.RegularExpressions.Generated	80.3%	67.8%
System.Text.RegularExpressions.Generated	80.3%	67.8%
System.Text.RegularExpressions.Generated.<RegexGenerator_g>F12A1AEDDDFE32BA DF4DBFF323AF1BCB48B9F9721B7CD3E05F5E034CF225E3DF8__CreateJweRegex_1	79.2%	68%
System.Text.RegularExpressions.Generated.<RegexGenerator_g>F12A1AEDDDFE32BA DF4DBFF323AF1BCB48B9F9721B7CD3E05F5E034CF225E3DF8__CreateJwsRegex_0	81.4%	67.6%
System.Text.RegularExpressions.Generated.<RegexGenerator_g>F334844C618E00D3 CEC5D3FE0D00CF0141BBEE98635313BB2CB8D3921464CE05A__CreateJweRegex_1	79.2%	68%
System.Text.RegularExpressions.Generated.<RegexGenerator_g>F334844C618E00D3 CEC5D3FE0D00CF0141BBEE98635313BB2CB8D3921464CE05A__CreateJwsRegex_0	81.4%	67.6%

[jennyf19]

Re-setting my review, I need a bit more time to look at this.

[GeoK]

I don't think that this is sufficient. We should signal metadata refresh only if encryption keys are part of metadata.