Remove M.IM.Tokens.Experimental namespace - Graduate result-based validation API

[Copilot]

Remove M.IM.Tokens.Experimental namespace

• You've read the Contributor Guide and Code of Conduct.
• You've included unit or integration tests for your change, where applicable.
• You've included inline docs for your change, where applicable.
• If any gains or losses in performance are possible, you've included benchmarks for your changes. More info
• There's an open issue for the PR that you are making. If you'd like to propose a new feature or change, please open an issue to discuss the change or find an existing issue.

Graduates result-based validation API from experimental namespace. Makes IResultBasedValidation available on all token handlers via base TokenHandler class.

Description

Breaking Changes:

• All types moved from Microsoft.IdentityModel.Tokens.Experimental → Microsoft.IdentityModel.Tokens
• TokenHandler now implements IResultBasedValidation
• ValidateTokenAsync(ValidationParameters) methods now public (were internal)

Namespace Migration:

• Moved validation result types: ValidationResult<TResult, TError>, ValidatedToken, ValidationError, ValidationParameters
• Moved validation failure types: ValidationFailureType, all specific error types
• Moved validation delegates: AlgorithmValidationDelegate, AudienceValidationDelegate, IssuerValidationDelegateAsync, etc.
• Merged experimental delegates into main Delegates.cs

Handler Changes:

• JsonWebTokenHandler: Changed internal override → public override for ValidateTokenAsync methods
• SamlSecurityTokenHandler: Same as above
• Saml2SecurityTokenHandler: Same as above
• Removed explicit IResultBasedValidation interface implementations (now on base class)

Before:

if (handler is IResultBasedValidation resultBasedHandler)
{
    var result = await resultBasedHandler.ValidateTokenAsync(token, validationParams, callContext);
}

After:

// Works with any TokenHandler
var result = await handler.ValidateTokenAsync(token, validationParams, callContext);

Migration Guide:

• Update using statements: Remove .Experimental from namespace imports
• Update type references: Experimental.ValidationResult → ValidationResult
• No logic changes required for consumers already using the experimental API

Original prompt

---

This section details on the original issue you should resolve

<issue_title>[Feature Request] Remove M.IM.Tokens.Experimental namespace.</issue_title>
<issue_description>We have a new model for validating tokens without throwing exceptions which results in a reduced memory footprint and improved latency.

Currently we have most of the code in M.IM.Tokens.Experimental namespace.
Removing this namespace will be a breaking change.

We will need to bump the major version before we do this.
We would like for the methods on IResultBasedValidation to be available for all TokenHandlers.
Currently IResultBasedValidation was added to JsonWebTokenHandler, SamlSecurityTokenHandler and Saml2SecurityTokenHandler.
Which implies an opt in model on a TokenHandler basis, which results in the need for logic based on type.

To resolve this:

1. IResultBasedValidation methods could be added to M.IM.Tokens.TokenHandler.
2. IResultBasedValidation could be added as an interface to M.IM.Tokens.TokenHandler.

The result should be that any runtime working with a TokenHandler should be able to call the new methods.</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes [Feature Request] Remove M.IM.Tokens.Experimental namespace. #3300

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.