Bug: Incorrect `JsonConverter` type used on `User` model

[ZeBobo5]

Checklist

• I have looked into the Readme and have not found a suitable solution or answer.
• I have looked into the API documentation and have not found a suitable solution or answer.
• I have searched the issues and have not found a suitable solution or answer.
• I have searched the Auth0 Community forums and have not found a suitable solution or answer.
• I agree to the terms within the Auth0 Code of Conduct.

Description

The User model uses StringOrObjectAsStringConverter, which is a converter implemented for System.Text.Json.

However, the property is decorated with the Newtonsoft.Json JsonConverter attribute:

[JsonConverter(typeof(StringOrObjectAsStringConverter))]

Newtonsoft.Json.JsonConverter and System.Text.Json.Serialization.JsonConverter are not compatible, so this converter will never work correctly with Newtonsoft and may even result in runtime or compilation issues depending on the implementation.

Reference:

auth0.net/src/Auth0.ManagementApi/Models/Users/User.cs

Line 51 in fac6642

[JsonConverter(typeof(StringOrObjectAsStringConverter))]

I believe the converter should either:

• be replaced with a Newtonsoft.Json.JsonConverter implementation, or
• the model should consistently use System.Text.Json attributes and converters if the SDK is migrating away from Newtonsoft.

Reproduction

Just make a call to user by email endpoint.

Additional context

System.InvalidCastException: Unable to cast object of type 'Auth0.Core.Serialization.StringOrObjectAsStringConverter' to type 'Newtonsoft.Json.JsonConverter

auth0.net version

7

.NET version

10

[kailash-b]

Hi @ZeBobo5 👋

Thanks for reaching out.
It seems you are still on the v7 version of the Auth0.ManagementApi which went out of support when v8 version was released.

We recommend you migrate to the latest available versions of Auth0.ManagementApi to get the benefit of latest features and continuous support. We have detailed migration guides (v7 to v8, v8 to v9) which should help in your migration journey.
Do reach out, if you face any issues in the process. If you feel something is missing in the latest versions that is blocking you from an upgrade, do reach out to us. We can work together to unblock your use cases.

The latest versions of Auth0.ManagementApi already use System.Text.Json and hence you should not see this problem on the latest versions.

[ZeBobo5]

Thanks for the clarification.

I understand that v7 is no longer supported, but ending support immediately after the release of v8, v9 or v10 soon... (which were released only 3 months ago) is difficult to accommodate in many enterprise environments. Upgrading a dependency like this isn't something we can do overnight. It has to be planned, tested, benchmarked, validated, and scheduled alongside the rest of the project.

On top of that, major version upgrades inevitably carry a risk of regressions. For example, issue #969 demonstrates that there are still migration-related problems to consider. Because of that, it's not always reasonable to migrate immediately after a rewrite of a new major release.

My point wasn't to request new features on v7, but to report what appears to be an implementation bug in the last v7 release. Even if it's not going to be fixed because the version is out of support, I think it's still worth acknowledging that it's a bug rather than simply recommending an upgrade.

Thanks again for your response.

[kailash-b]

Hi @ZeBobo5 👋

This is indeed an issue. I dug into it and I want to share what I found, because the root cause turned out to be slightly different from what it seems.

The User model and the converter it points to are consistent in the v7 release (StringOrObjectAsStringConverter is a Newtonsoft.Json implementation, and User.cs pairs it correctly with [JsonProperty]).

What's actually happening is a package resolution problem, one level down in Auth0.Core.
From Auth0.Core v7.48.0 onwards, we reimplemented StringOrObjectAsStringConverter on top of System.Text.Json (it now derives from System.Text.Json.Serialization.JsonConverter<string> instead of Newtonsoft.Json.JsonConverter).

Up until v7.47.0, Auth0.Core was still using the Newtonsoft.Json implementation and this mismatch was not possible.
Auth0.ManagementApi does not ship Auth0.Core.dll as part of its package, instead it is referenced as a NuGet dependency with a minimum version. This means Auth0.Core gets resolved at restore time, and if it resolves to >= 7.48.0, the v7 Auth0.ManagementApi ends up binding its Newtonsoft.Json converter attribute to a System.Text.Json converter type.
That probably is why we are seeing the InvalidCastException.

That usually happens if we are also on a recent Auth0.AuthenticationApi (7.48.0 requires Auth0.Core >= 7.48.0), or you've manually bumped Auth0.Core.
The work around is to cap the Auth0.AuthenticationApi version to 7.47.0. OR if you aren't using Auth0.AuthenticationApi, ensure Auth0.Core package is capped to 7.47.0.

This issue has arisen because we moved away from Newtonsoft.Json in Auth0.Core 7.48.0. You won't hit this on the latest Auth0.ManagementApi used alongside Auth0.AuthenticationApi, but we do acknowledge it can occur in exactly your scenario, v7 Auth0.ManagementApi combined with the latest Auth0.AuthenticationApi.
That's a packaging mismatch introduced on our side, and we'll discuss internally what we can do about it.

Thanks!