asp.net core - Purpose of options.AutomaticAuthenticate with UseJwtBearerAuthentication -

after updating codebase asp 5 beta 7 rc1-final, began receiving exception jwtbearer middleware

unable cast object of type 'newtonsoft.json.linq.jarray' type 'system.iconvertible'. 

the determining factor can see far appears setting of options.automaticauthenticate. if it's true, exception, otherwise, not.

what automaticauthenticate , why need enable it?

    app.usejwtbearerauthentication(options =>     {         options.automaticauthenticate = true;      } 

here full stack trace:

at system.convert.toint32(object value, iformatprovider provider)    @ system.identitymodel.tokens.jwt.jwtpayload.getintclaim(string claimtype)    @ system.identitymodel.tokens.jwt.jwtpayload.get_nbf()    @ system.identitymodel.tokens.jwt.jwtsecuritytokenhandler.validatetoken(string token, tokenvalidationparameters validationparameters, securitytoken& validatedtoken)    @ microsoft.aspnet.authentication.jwtbearer.jwtbearerhandler.<handleauthenticateasync>d__1.movenext() --- end of stack trace previous location exception thrown ---    @ system.runtime.exceptionservices.exceptiondispatchinfo.throw()    @ microsoft.aspnet.authentication.jwtbearer.jwtbearerhandler.<handleauthenticateasync>d__1.movenext() --- end of stack trace previous location exception thrown ---    @ system.runtime.compilerservices.taskawaiter.throwfornonsuccess(task task)    @ system.runtime.compilerservices.taskawaiter.handlenonsuccessanddebuggernotification(task task)    @ system.runtime.compilerservices.taskawaiter`1.getresult()    @ microsoft.aspnet.authentication.authenticationhandler`1.<initializeasync>d__48.movenext() --- end of stack trace previous location exception thrown ---    @ system.runtime.compilerservices.taskawaiter.throwfornonsuccess(task task)    @ system.runtime.compilerservices.taskawaiter.handlenonsuccessanddebuggernotification(task task)    @ system.runtime.compilerservices.taskawaiter.getresult()    @ microsoft.aspnet.authentication.authenticationmiddleware`1.<invoke>d__18.movenext() --- end of stack trace previous location exception thrown ---    @ system.runtime.compilerservices.taskawaiter.throwfornonsuccess(task task)    @ system.runtime.compilerservices.taskawaiter.handlenonsuccessanddebuggernotification(task task)    @ system.runtime.compilerservices.taskawaiter.getresult()    @ api.startup.<<configure>b__9_0>d.movenext() in ...\startup.cs:line 156 

update on root cause

our codebase creating duplicate claims nbf, exp, , iat. explains why get_nbf in stack trace , complaint "jarray" since each of values array instead of value.

if set true middleware run on every inbound request, jwt token , if 1 present validate it, , if valid create identity , add current user.

if false doesn't happen , need request middleware set identity specifying bearer's scheme in authorize attribute.

[authorize(authenticationschemes = "yourbearerschemename")] 

or set in policy;

options.addpolicy("requirebearer", policy => {     policy.authenticationschemes.add("yourbearerschemename");     policy.requireauthenticateduser();  }); 

so, setting false aren't running bearer stuff until ask it, you're putting exception off until later.