I have followed the duende tutorials up until 5 (adding the identity framework). I have completed the tutorial (i.e. I have a razor client, a c# api, and an identity server application).
I then went ahead and removed the favorite color, and added other fields such as nickname, city, country (amongst others).
I made the necessary modifications to the identity server (namely updated the mapping service to map user data to claims, and one IdentityResource to represent all my custom claims (nickname, country, city etc).
IdentityServer Configured as follows:
IEnumerable<IdentityResource> IdentityResources =
new List<IdentityResource>
{
new IdentityResources.OpenId(),
new IdentityResources.Profile(),
new IdentityResource("myApi.Data", new [] { nameof(User.NickName),
nameof(User.Country),
nameof(User.City)})};
IEnumerable<ApiScope> ApiScopes =
new List<ApiScope>
{
new ApiScope("api1", "My API"),
new ApiScope(IdentityServerConstants.LocalApi.ScopeName)
};
IEnumerable<Client> Clients =
new List<Client>
{
// interactive ASP.NET Core Web App
new Client
{
ClientId = "web",
ClientSecrets = { new Secret("secret".Sha256()) },
AllowedGrantTypes = GrantTypes.Code,
// where to redirect to after login
RedirectUris = { "https://localhost:7070/signin-oidc" },
// where to redirect to after logout
PostLogoutRedirectUris = { "https://localhost:7070/signout-callback-oidc" },
AllowOfflineAccess = true,
AllowedScopes = new List<string>
{
IdentityServerConstants.StandardScopes.OpenId,
IdentityServerConstants.StandardScopes.Profile,
"api1",
"myApi.Data",
IdentityServerConstants.LocalApi.ScopeName
}
}
};
builder.Services
.AddIdentityServer(options =>
{
options.Events.RaiseErrorEvents = true;
options.Events.RaiseInformationEvents = true;
options.Events.RaiseFailureEvents = true;
options.Events.RaiseSuccessEvents = true;
// see https://docs.duendesoftware.com/identityserver/v6/fundamentals/resources/
options.EmitStaticAudienceClaim = true;
})
.AddInMemoryIdentityResources(IdentityResources)
.AddInMemoryApiScopes(ApiScopes)
.AddInMemoryClients(Clients)
.AddAspNetIdentity<User>()
.AddProfileService<CustomProfileService>();
The Razor Client uses the following piece of code to authenticate vs idsvr (using addOpenIdConnect):
builder.Services.AddAuthentication(options =>
{
options.DefaultScheme = "Cookies";
options.DefaultChallengeScheme = "oidc";
})
.AddCookie("Cookies")
.AddOpenIdConnect("oidc", options =>
{
options.Authority = "https://localhost:44302";
options.ClientId = "web";
options.ClientSecret = "secret";
options.ResponseType = "code";
options.SaveTokens = true;
options.Scope.Clear();
options.Scope.Add("openid");
options.Scope.Add("profile");
options.Scope.Add("offline_access");
options.Scope.Add("api1");
options.Scope.Add("myApi.Data");
options.Scope.Add("IdentityServerApi");
options.GetClaimsFromUserInfoEndpoint = true;
options.ClaimActions.MapAll();
});
MyApi is connected to the identity server as follows:
builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
.AddJwtBearer(options =>
{
options.Authority = "https://localhost:44302";
options.TokenValidationParameters.ValidateAudience = false;
options.MapInboundClaims = true;
});
I have noticed that the razor client is able to see my custom claims when looping through User.Claims:
However my api is also accessing User.Claims but sees much less data!
The client is sending the request to the api by passing the accessToken as a bearer:
Why is this so?
Update following tips:
I have followed the debugging for my client, and can see my fields from the get user information endpoint, but not from the id token:
As for my api, I added the logic for on token validated and can see the claims, but not my custom claims:
Since the client is using cookies, but the api is working through a JWTBearer, could it be that my access token does not have this user information? Makes sense because the access token should not have personal information but rather the users access, and I have defined my claims as Identity resource. How would I go about it if I would require the access the user information claims by the api which is working through JWTBearer and not OpenIdconnect/Cookies?
Update 2: I have changed my idsvr config to have my custom claims as an api Scope, and now I can see my custom claims in my access token from the web api, however now the UI cannot see these claims!.
