…hange

In dnnsoftware#6356 a dependency update made an unintentional breaking change. Instead of the classic "role" claim we now give a "http://schemas.microsoft.com/ws/2008/06/identity/claims/role" claim for roles.

JWT in itself has no specs for roles or claims which is left to whatever implementation is targetted like OIDC, OAuth, etc.

In DNN context it is a simple JWT but we do provide roles and the new package email values uses microsoft "standard" values that have been around in the Microsoft ecosystem since .Net Framework 4.5 and still lives all the way up to .Net 10.

I am not sure if we should support our old "role" claim forever or the Microsoft claim as there are 0 specs about "role". IETF does have a spec about "roles" so if we would change it to that spec, it would still be a breaking change.

What this PR does is provide both the old (<=9.13.9) behavior of "role" as well as the new microsoft way which may be better known in the .Net ecosystem. It also adds a deprecation note on both the plain and encrypted token to try and bring attention to this breacking change with the old way being obsolete and removed in v12.

Closes dnnsoftware#6829

…hange (#6832)

In #6356 a dependency update made an unintentional breaking change. Instead of the classic "role" claim we now give a "http://schemas.microsoft.com/ws/2008/06/identity/claims/role" claim for roles.

JWT in itself has no specs for roles or claims which is left to whatever implementation is targetted like OIDC, OAuth, etc.

In DNN context it is a simple JWT but we do provide roles and the new package email values uses microsoft "standard" values that have been around in the Microsoft ecosystem since .Net Framework 4.5 and still lives all the way up to .Net 10.

I am not sure if we should support our old "role" claim forever or the Microsoft claim as there are 0 specs about "role". IETF does have a spec about "roles" so if we would change it to that spec, it would still be a breaking change.

What this PR does is provide both the old (<=9.13.9) behavior of "role" as well as the new microsoft way which may be better known in the .Net ecosystem. It also adds a deprecation note on both the plain and encrypted token to try and bring attention to this breacking change with the old way being obsolete and removed in v12.

Closes #6829