身份服务器 - 如何包含令牌附加声明（来自外部身份提供者）

Question

我很难找到有关如何从身份服务器向我的客户端应用程序发送附加声明的可靠信息。

目前，我正在使用以下内容获取本地声明（我在 ProcessLoginCallbackForOidc 中捕获）并添加到身份验证期间返回的声明中。

这是最好的方法吗？

public class ProfileService : IProfileService
    {
        public Task GetProfileDataAsync(ProfileDataRequestContext context)
        {
            //var sub = context.Subject.GetSubjectId();
            var claims = context.Subject.Claims.ToList();
            if (claims.Count > 0)
            {
                var emailClaim = claims.FirstOrDefault(x => x.Type == "email");
                if (emailClaim == null)
                {
                    var emailAddressClaim = context.Subject.Claims.FirstOrDefault(x => x.Type == "emails");
                    if (emailAddressClaim != null)
                    {
                        claims.Add(new Claim("email", emailAddressClaim.Value));
                    }
                }
            }

            // Set returned claims (System.Security.Claims.Claim) by setting context.IssuedClaims
            context.IssuedClaims = claims;

            return Task.CompletedTask;
        }

        public Task IsActiveAsync(IsActiveContext context)
        {
            context.IsActive = true;
            return Task.CompletedTask;
        }
    }

Answer 1

是的，这是正确的解决方案。 ProfileService 是为用户添加额外声明的扩展点。 它在为用户创建令牌时调用。

阅读更多here

编辑： 以下是配置文件服务的示例代码：

public class ProfileService : IProfileService
{
    private readonly IUserClaimsPrincipalFactory<ApplicationUser> _claimsFactory;
    private readonly UserManager<ApplicationUser> _userManager;

    public ProfileService(UserManager<ApplicationUser> userManager, IUserClaimsPrincipalFactory<ApplicationUser> claimsFactory)
    {
        _userManager = userManager;
        _claimsFactory = claimsFactory;
    }

    public async Task GetProfileDataAsync(ProfileDataRequestContext context)
    {
        var sub = context.Subject.GetSubjectId();
        var user = await _userManager.FindByIdAsync(sub);
        var principal = await _claimsFactory.CreateAsync(user);

        var claims = principal.Claims.ToList();

        if (claims.Count > 0)
        {
             var emailClaim = claims.FirstOrDefault(x => x.Type == "email");
             if (emailClaim == null)
             {
                 var emailAddressClaim = context.Subject.Claims.FirstOrDefault(x => x.Type == "emails");
                 if (emailAddressClaim != null)
                 {
                     claims.Add(new Claim("email", emailAddressClaim.Value));
                 }
             }
         }

         context.IssuedClaims = claims;

         return Task.CompletedTask;   
    }

    public async Task IsActiveAsync(IsActiveContext context)
    {
        var sub = context.Subject.GetSubjectId();
        var user = await _userManager.FindByIdAsync(sub);
        context.IsActive = user != null;
    }
}