[BUG] DiagnosticHostedService fails with NotSupportedException when DynamicProviders.PathMatchingCallback is set

[DaleyKD]

Please keep in mind this was investigated by AI and the bug report was also written by it.

---

Description

When using a custom PathMatchingCallback for dynamic identity providers, the DiagnosticHostedService throws a NotSupportedException at startup because it attempts to JSON-serialize the IdentityServerOptions object, which contains a Func<HttpContext, Task<string>> delegate that cannot be serialized.

Version

• Duende IdentityServer: 7.4.6
• .NET: 10.0

Steps to Reproduce

1. Configure IdentityServer with a custom PathMatchingCallback:

services.Configure<IdentityServerOptions>(opt =>
{
    opt.DynamicProviders.PathMatchingCallback = ctx => MyPathMatchingAsync(ctx);
    opt.DynamicProviders.AddProviderType<Saml2Handler, Saml2Options, MyIdentityProvider>("saml");
});

2. Start the application
3. The DiagnosticHostedService throws an exception during startup

Expected Behavior

The application should start successfully. The diagnostic service should either:

• Skip serializing delegate properties, or
• Mark PathMatchingCallback with [JsonIgnore]

Actual Behavior

The application throws a NotSupportedException with the message:

Serialization and deserialization of 'System.Func2[Microsoft.AspNetCore.Http.HttpContext,System.Threading.Tasks.Task1[System.String]]' instances is not supported. Path: $.DynamicProviders.PathMatchingCallback.

Full Stack Trace

System.NotSupportedException: Serialization and deserialization of 'System.Func`2[[Microsoft.AspNetCore.Http.HttpContext, Microsoft.AspNetCore.Http.Abstractions, Version=10.0.0.0, Culture=neutral, PublicKeyToken=adb9793829ddae60],[System.Threading.Tasks.Task`1[[System.String, System.Private.CoreLib, Version=10.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e]], System.Private.CoreLib, Version=10.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e]]' instances is not supported. The unsupported member type is located on type 'System.Func`2[Microsoft.AspNetCore.Http.HttpContext,System.Threading.Tasks.Task`1[System.String]]'. Path: $.DynamicProviders.PathMatchingCallback.
 ---> System.NotSupportedException: Serialization and deserialization of 'System.Func`2[[Microsoft.AspNetCore.Http.HttpContext, Microsoft.AspNetCore.Http.Abstractions, Version=10.0.0.0, Culture=neutral, PublicKeyToken=adb9793829ddae60],[System.Threading.Tasks.Task`1[[System.String, System.Private.CoreLib, Version=10.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e]], System.Private.CoreLib, Version=10.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e]]' instances is not supported.
   at System.Text.Json.Serialization.Converters.UnsupportedTypeConverter`1.Write(Utf8JsonWriter writer, T value, JsonSerializerOptions options)
   at System.Text.Json.Serialization.JsonConverter`1.TryWrite(Utf8JsonWriter writer, T& value, JsonSerializerOptions options, WriteStack& state)
   at System.Text.Json.Serialization.Metadata.JsonPropertyInfo`1.GetMemberAndWriteJson(Object obj, WriteStack& state, Utf8JsonWriter writer)
   at System.Text.Json.Serialization.Converters.ObjectDefaultConverter`1.OnTryWrite(Utf8JsonWriter writer, T value, JsonSerializerOptions options, WriteStack& state)
   at System.Text.Json.Serialization.JsonConverter`1.TryWrite(Utf8JsonWriter writer, T& value, JsonSerializerOptions options, WriteStack& state)
   at System.Text.Json.Serialization.Metadata.JsonPropertyInfo`1.GetMemberAndWriteJson(Object obj, WriteStack& state, Utf8JsonWriter writer)
   at System.Text.Json.Serialization.Converters.ObjectDefaultConverter`1.OnTryWrite(Utf8JsonWriter writer, T value, JsonSerializerOptions options, WriteStack& state)
   at System.Text.Json.Serialization.JsonConverter`1.WriteCore(Utf8JsonWriter writer, T& value, JsonSerializerOptions options, WriteStack& state)
   --- End of inner exception stack trace ---
   at System.Text.Json.ThrowHelper.ThrowNotSupportedException(WriteStack& state, Exception innerException)
   at System.Text.Json.Serialization.JsonConverter`1.WriteCore(Utf8JsonWriter writer, T& value, JsonSerializerOptions options, WriteStack& state)
   at System.Text.Json.Serialization.Metadata.JsonTypeInfo`1.Serialize(Utf8JsonWriter writer, T& rootValue, Object rootValueBoxed)
   at System.Text.Json.JsonSerializer.Serialize[TValue](Utf8JsonWriter writer, TValue value, JsonSerializerOptions options)
   at Duende.IdentityServer.Licensing.V2.Diagnostics.DiagnosticEntries.IdentityServerOptionsDiagnosticEntry.WriteAsync(DiagnosticContext context, Utf8JsonWriter writer) in /_/identity-server/src/IdentityServer/Licensing/V2/Diagnostics/DiagnosticEntries/IdentityServerOptionsDiagnosticEntry.cs:line 30
   at Duende.IdentityServer.Services.DiagnosticDataService.GetJsonBytesAsync(CancellationToken cancellationToken) in /_/identity-server/src/IdentityServer/Services/DiagnosticDataService.cs:line 33
   at Duende.IdentityServer.Services.DiagnosticDataService.GetJsonBytesAsync(CancellationToken cancellationToken) in /_/identity-server/src/IdentityServer/Services/DiagnosticDataService.cs:line 42
   at Duende.IdentityServer.Licensing.V2.Diagnostics.DiagnosticSummary.PrintSummary() in /_/identity-server/src/IdentityServer/Licensing/V2/Diagnostics/DiagnosticSummary.cs:line 17
   at Duende.IdentityServer.Licensing.V2.Diagnostics.DiagnosticHostedService.ExecuteAsync(CancellationToken stoppingToken) in /_/identity-server/src/IdentityServer/Licensing/V2/Diagnostics/DiagnosticHostedService.cs:line 22

Suggested Fix

Add [JsonIgnore] attribute to the PathMatchingCallback property in DynamicProviderOptions, or configure a custom JsonSerializerOptions in IdentityServerOptionsDiagnosticEntry.WriteAsync that ignores delegate types.

Workaround

As a temporary workaround, we're removing the DiagnosticHostedService from the service collection:

var diagnosticDescriptor = services.FirstOrDefault(d =>
    d.ImplementationType?.FullName == "Duende.IdentityServer.Licensing.V2.Diagnostics.DiagnosticHostedService");
if (diagnosticDescriptor != null)
{
    services.Remove(diagnosticDescriptor);
}

[wcabus]

Thanks for reporting this issue!

Just to clarify, was this an actual issue you've encountered while running Duende IdentityServer, or was this something flagged by AI? We're trying to determine the severity of the issue, since this issue doesn't prevent IdentityServer from functioning, it only impacts the DiagnosticHostedService.

[DaleyKD]

Great question and I wasn't clear in my OP. It showed up in one of my local dev logs, and I just asked AI to see if it knew why.

Priority is definitely low because it does still work.