Add claims in token from web api

Question

I'm working on a project using IdentityServer4 and Identity and an API.

The API is protected with IDS4.

The API and IDS4 are on the same project, so I have 3 projects in my solutions: - A MVC web project that contains the IdentityServer and the API - An implementation of Identity that use MongoDB as database provider - A console application that simulate the client

My client authenticate with IDS4, get the access_token and then call the api with the token. This part is working fine.

Now i'm asked that when calling a specific action in my api I add some claims to the token.

I've searched on google but I can't found any solutions on how to do that, and I'm not sure it's a good idea. Can the API modifiy the received access token by adding some claims and then send back the token?

An alternative was to send another token as response but I can't find a way to sign my token with RS512.

Thanks in advance

No it's not a good idea. You shouldn't be able to modify token on consumer side at all. The right way is to get claims from token1, ask the identity server for new token (token2) with old claims and your new ones, and send back the token2 to the cliet. — amiry jd
I haven't think of this solution but I agree that's a better one. Can you give me any lead on how to achieve this? The "tricky" part is that the token claims will change based on which tenant the user want to connect — S.Martignier
Why does the api need to add claims to the token? What kind of information do you want to add? — Ruard van Elburg
If your have a small number (1-5) of tenants per user, you can/should put them all in the access token (maybe even the identity token, if tenant information is considered part of the identity) and check it on the server if he is eligible to access that method for the given tenant. If you high number or complex tenant assignments, fetch that data from the database (if you have valid concerns/proof that this causes performance issues, cache the value for a specific time to reduce db hits). — Tseng
I use IDS4 to secure my API that offer the following process (among others) : A user connect in the client with IDS4, then he can choose which tenant he will access and depending on the tenant he choose he will have some licenses that allow him to access some functionnality in the client. So the basic (bad) idea was to add the licences as claim in the token after he choose a tenant. — S.Martignier

Tarik Tutuncu Tarik Tutuncu · Accepted Answer · 2018-12-05T11:19:14

You can add extra claims using IProfileService

public class ProfileService : IProfileService
{
    public Task GetProfileDataAsync(ProfileDataRequestContext context)
    {
        string subject = context.Subject.Claims.ToList().Find(s => s.Type == "sub").Value;
        try
        {
            // Get Claims From Database, And Use Subject To Find The Related Claims, As A Subject Is An Unique Identity Of User
            //List<string> claimStringList = ......
            if (claimStringList == null)
            {
                return Task.FromResult(0);
            }
            else {
                List<Claim> claimList = new List<Claim>();
                for (int i = 0; i < claimStringList.Count; i++)
                {
                    claimList.Add(new Claim("role", claimStringList[i]));
                }
                context.IssuedClaims = claimList.Where(x => context.RequestedClaimTypes.Contains(x.Type));
                return Task.FromResult(0);
            }
        }
        catch
        {
            return Task.FromResult(0);
        }
    }

    public Task IsActiveAsync(IsActiveContext context)
    {
        return Task.FromResult(0);
    }
}

Register service in the "Startup" file:

public void ConfigureServices(IServiceCollection services)
{
    services.AddIdentityServer()..Services.AddTransient<IProfileService, ProfileService>();
}

Add claims in token from web api

1 Answers