Why ASP.NET Core adds claims twice into User.Claims property?

Question

I have asp.net core application and the application is using OpenIdConnect authentication using IdentityServer3. When the user is authenticated successfully the application receives proper claims from identity server. I can debug the line TokenValidatedContext.Ticket.Principal.Claims in OnTokenValidatd and make sure application receives all the claims.

Code Snippet

    var connectOptions = new OpenIdConnectOptions()
        {
            AutomaticAuthenticate = true,
            AutomaticChallenge = true,
            Authority = authority,
            ClientId = clientId,
            ResponseType = IdentityConstant.IdTokenClaim,
            AuthenticationScheme = IdentityConstant.OpenIdAuthenticationScheme,
            SignInScheme = CookieAuthenticationDefaults.AuthenticationScheme,
            PostLogoutRedirectUri = postlogoutRedirectUri,
            CallbackPath = IdentityConstant.CallbackPath,
            Events = new OpenIdConnectEvents()
            {
                OnTokenValidated = async context =>
                {
                    var claims = context.Ticket.Principal.Claims;
                    await Task.FromResult(0);
                }
            }
        };

below is the quick watch of TokenValidatedContext.Ticket.Principal.Claims in OnTokenValidated handler

However, after successful authentication when I debug User.Cliams in Home controller, I see all the claims are added twice.
Below is the quick watch of User.Claims in Home controller

Why the claims are getting added twice in User.Claims?

i can't tell how you're seeing that the claims are duplicated... — DForck42, Oct 05 '16 at 18:40

score 5 · Accepted Answer · answered Oct 05 '16 at 21:25

5

Because you set openidconnect's AutomaticAuthenticate to true. If you look user identities you will see there are two identities(One for cookie other for openidconnect authentication). Since User.Claims are sum of these identity claims, you see claims twice. So, removing AutomaticAuthenticate = true, from openidconnect options solves the problem.

answered Oct 05 '16 at 21:25

adem caglin

22,700
10
58
78

I removed `AutomaticAuthenticate = true` from OpenIdConnectOptions and left it for CookieAuthentication.. It worked!!! – LP13 Oct 05 '16 at 22:16

Why ASP.NET Core adds claims twice into User.Claims property?

1 Answers1

Linked