IdentityServer4 - 'sub' claim is missing

3
votes

I've created a sample MVC application which uses identity server to do the authentication against Google. Authentication works ok but when the response comes back it is missing 'sub' claim and end up with the error that says 'sub claim is missing'.

I read few article which talks about claimmapping to map nameidentifier to sub. but have no idea on how to do that. There are someblog which says to inform google to issue the sub claim. but again not sure how to do that.

Looking forward for some help!

3
google-app-engineoauth-2.0identityserver4claims
Did you ever work this out @HimalPatel? Up against the same thing and no amount of configuration seems to change anything. - mikeo
@mikeo yes, i got it working. Please let me know if you want me to post the solution. - Himal Patel

3 Answers

7
votes

Maybe similar to what I was seeing yesterday. I found a workaround here

Basically some standard claims get mapped to MS proprietary keys by default. You can prevent that by doing : JwtSecurityTokenHandler.DefaultInboundClaimTypeMap.Clear();

Hope that helps!

0
votes

Have a look at JwtSecurityTokenHandler.InboundClaimTypeMap. It lets you specify how claims from JWTs are mapped to claims in a ClaimsIdentity. Another option is to investigate the events exposed by the OIDC middleware, they may allow you to intercept and manipulate the claims coming back from Google.

0
votes

Or more specifically you can also use the following

JwtSecurityTokenHandler.DefaultInboundClaimTypeMap.Remove("sub");