Skip to content

Commit 56ae90f

Browse files
vladimir-pecanac-mainvladimir-pecanac-main
authored
AddingCustomClaimsToAccessTokenInDuende: migrate to Duende IdentityServer 8 on net10.0 (#2083)
Retargets every project to net10.0 and moves the sample from Duende.IdentityServer 6.3.7 to 8.0.5, which is a real v6 -> v8 migration rather than a package bump. IdentityServer v8 changes applied (per Duende's 7.4 -> 8.0 upgrade guide): * Every store/service interface method gained a CancellationToken parameter, so IProfileService.GetProfileDataAsync/IsActiveAsync take one now. * ProfileDataRequestContext.Client was renamed to .Application and retyped to IConnectedApplication, so the client id is read as Application?.Identifier rather than Client.ClientId. * The IdentityModel package/namespace became Duende.IdentityModel. * v8 requires .NET 10; nullable reference types are enabled across the assemblies. Those changes cascade through the whole stock quickstart UI, so Pages/ and wwwroot/ are regenerated from Duende's own v8 in-memory template (Duende.Templates 1.3.0) with the namespace adjusted. That also moves Pages/Home/Error to Pages/Error and swaps bootstrap4-glyphicons for bootstrap-icons. Article content added alongside the migration: * Config.ApiResources declares a "paymentsapi" resource whose UserClaims include the role claim, so Duende requests the role claim type for that audience. * CustomProfileService issues the role claim through AddRequestedClaims, because a custom IProfileService replaces the built-in one and is then the only source of user claims. * A new Api project consumes the token with AddJwtBearer. MapInboundClaims is set to false there: with the default inbound claim mapping the "role" claim arrives under the legacy schemas.microsoft.com URI and RequireRole silently fails. * One test covers the new ApiResource declaration. Verified on .NET SDK 10.0.302 / ASP.NET Core runtime 10.0.10: solution builds in Release, 7/7 tests pass, and an end-to-end authorization-code + PKCE login as alice returns an access token carrying tenant, payments.discount and role claims with paymentsapi in the audience; the role-protected API endpoint answers 200 with the token and 401 without it.
1 parent 39bbe7a commit 56ae90f

125 files changed

Lines changed: 25178 additions & 31373 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎authorization-dotnet/AddingCustomClaimsToAccessTokenInDuende/.gitignore‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
# Duende automatic key management writes signing keys here at first run.
2+
keys/

‎authorization-dotnet/AddingCustomClaimsToAccessTokenInDuende/AddingCustomClaimsToAccessTokenInDuende.sln‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,24 +9,66 @@ Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "WebClient", "WebClient\WebC
99
EndProject
1010
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Tests", "Tests\Tests.csproj", "{75F68889-23DC-4EC2-8B78-F5C8DC75FB37}"
1111
EndProject
12+
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Api", "Api\Api.csproj", "{23F6BA94-D4F4-47B9-9D9F-1FE56FF22428}"
13+
EndProject
1214
Global
1315
GlobalSection(SolutionConfigurationPlatforms) = preSolution
1416
Debug|Any CPU = Debug|Any CPU
17+
Debug|x64 = Debug|x64
18+
Debug|x86 = Debug|x86
1519
Release|Any CPU = Release|Any CPU
20+
Release|x64 = Release|x64
21+
Release|x86 = Release|x86
1622
EndGlobalSection
1723
GlobalSection(ProjectConfigurationPlatforms) = postSolution
1824
{8D058D23-748E-4F5C-A4DA-162526B3934A}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
1925
{8D058D23-748E-4F5C-A4DA-162526B3934A}.Debug|Any CPU.Build.0 = Debug|Any CPU
26+
{8D058D23-748E-4F5C-A4DA-162526B3934A}.Debug|x64.ActiveCfg = Debug|Any CPU
27+
{8D058D23-748E-4F5C-A4DA-162526B3934A}.Debug|x64.Build.0 = Debug|Any CPU
28+
{8D058D23-748E-4F5C-A4DA-162526B3934A}.Debug|x86.ActiveCfg = Debug|Any CPU
29+
{8D058D23-748E-4F5C-A4DA-162526B3934A}.Debug|x86.Build.0 = Debug|Any CPU
2030
{8D058D23-748E-4F5C-A4DA-162526B3934A}.Release|Any CPU.ActiveCfg = Release|Any CPU
2131
{8D058D23-748E-4F5C-A4DA-162526B3934A}.Release|Any CPU.Build.0 = Release|Any CPU
32+
{8D058D23-748E-4F5C-A4DA-162526B3934A}.Release|x64.ActiveCfg = Release|Any CPU
33+
{8D058D23-748E-4F5C-A4DA-162526B3934A}.Release|x64.Build.0 = Release|Any CPU
34+
{8D058D23-748E-4F5C-A4DA-162526B3934A}.Release|x86.ActiveCfg = Release|Any CPU
35+
{8D058D23-748E-4F5C-A4DA-162526B3934A}.Release|x86.Build.0 = Release|Any CPU
2236
{EA3E4FDE-43D5-4930-81BC-B3B2BE780714}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
2337
{EA3E4FDE-43D5-4930-81BC-B3B2BE780714}.Debug|Any CPU.Build.0 = Debug|Any CPU
38+
{EA3E4FDE-43D5-4930-81BC-B3B2BE780714}.Debug|x64.ActiveCfg = Debug|Any CPU
39+
{EA3E4FDE-43D5-4930-81BC-B3B2BE780714}.Debug|x64.Build.0 = Debug|Any CPU
40+
{EA3E4FDE-43D5-4930-81BC-B3B2BE780714}.Debug|x86.ActiveCfg = Debug|Any CPU
41+
{EA3E4FDE-43D5-4930-81BC-B3B2BE780714}.Debug|x86.Build.0 = Debug|Any CPU
2442
{EA3E4FDE-43D5-4930-81BC-B3B2BE780714}.Release|Any CPU.ActiveCfg = Release|Any CPU
2543
{EA3E4FDE-43D5-4930-81BC-B3B2BE780714}.Release|Any CPU.Build.0 = Release|Any CPU
44+
{EA3E4FDE-43D5-4930-81BC-B3B2BE780714}.Release|x64.ActiveCfg = Release|Any CPU
45+
{EA3E4FDE-43D5-4930-81BC-B3B2BE780714}.Release|x64.Build.0 = Release|Any CPU
46+
{EA3E4FDE-43D5-4930-81BC-B3B2BE780714}.Release|x86.ActiveCfg = Release|Any CPU
47+
{EA3E4FDE-43D5-4930-81BC-B3B2BE780714}.Release|x86.Build.0 = Release|Any CPU
2648
{75F68889-23DC-4EC2-8B78-F5C8DC75FB37}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
2749
{75F68889-23DC-4EC2-8B78-F5C8DC75FB37}.Debug|Any CPU.Build.0 = Debug|Any CPU
50+
{75F68889-23DC-4EC2-8B78-F5C8DC75FB37}.Debug|x64.ActiveCfg = Debug|Any CPU
51+
{75F68889-23DC-4EC2-8B78-F5C8DC75FB37}.Debug|x64.Build.0 = Debug|Any CPU
52+
{75F68889-23DC-4EC2-8B78-F5C8DC75FB37}.Debug|x86.ActiveCfg = Debug|Any CPU
53+
{75F68889-23DC-4EC2-8B78-F5C8DC75FB37}.Debug|x86.Build.0 = Debug|Any CPU
2854
{75F68889-23DC-4EC2-8B78-F5C8DC75FB37}.Release|Any CPU.ActiveCfg = Release|Any CPU
2955
{75F68889-23DC-4EC2-8B78-F5C8DC75FB37}.Release|Any CPU.Build.0 = Release|Any CPU
56+
{75F68889-23DC-4EC2-8B78-F5C8DC75FB37}.Release|x64.ActiveCfg = Release|Any CPU
57+
{75F68889-23DC-4EC2-8B78-F5C8DC75FB37}.Release|x64.Build.0 = Release|Any CPU
58+
{75F68889-23DC-4EC2-8B78-F5C8DC75FB37}.Release|x86.ActiveCfg = Release|Any CPU
59+
{75F68889-23DC-4EC2-8B78-F5C8DC75FB37}.Release|x86.Build.0 = Release|Any CPU
60+
{23F6BA94-D4F4-47B9-9D9F-1FE56FF22428}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
61+
{23F6BA94-D4F4-47B9-9D9F-1FE56FF22428}.Debug|Any CPU.Build.0 = Debug|Any CPU
62+
{23F6BA94-D4F4-47B9-9D9F-1FE56FF22428}.Debug|x64.ActiveCfg = Debug|Any CPU
63+
{23F6BA94-D4F4-47B9-9D9F-1FE56FF22428}.Debug|x64.Build.0 = Debug|Any CPU
64+
{23F6BA94-D4F4-47B9-9D9F-1FE56FF22428}.Debug|x86.ActiveCfg = Debug|Any CPU
65+
{23F6BA94-D4F4-47B9-9D9F-1FE56FF22428}.Debug|x86.Build.0 = Debug|Any CPU
66+
{23F6BA94-D4F4-47B9-9D9F-1FE56FF22428}.Release|Any CPU.ActiveCfg = Release|Any CPU
67+
{23F6BA94-D4F4-47B9-9D9F-1FE56FF22428}.Release|Any CPU.Build.0 = Release|Any CPU
68+
{23F6BA94-D4F4-47B9-9D9F-1FE56FF22428}.Release|x64.ActiveCfg = Release|Any CPU
69+
{23F6BA94-D4F4-47B9-9D9F-1FE56FF22428}.Release|x64.Build.0 = Release|Any CPU
70+
{23F6BA94-D4F4-47B9-9D9F-1FE56FF22428}.Release|x86.ActiveCfg = Release|Any CPU
71+
{23F6BA94-D4F4-47B9-9D9F-1FE56FF22428}.Release|x86.Build.0 = Release|Any CPU
3072
EndGlobalSection
3173
GlobalSection(SolutionProperties) = preSolution
3274
HideSolutionNode = FALSE

‎authorization-dotnet/AddingCustomClaimsToAccessTokenInDuende/Api/Api.csproj‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
<Project Sdk="Microsoft.NET.Sdk.Web">
2+
3+
<PropertyGroup>
4+
<TargetFramework>net10.0</TargetFramework>
5+
<Nullable>enable</Nullable>
6+
<ImplicitUsings>enable</ImplicitUsings>
7+
</PropertyGroup>
8+
9+
<ItemGroup>
10+
<PackageReference Include="Duende.IdentityModel" Version="8.1.0" />
11+
<PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.0" />
12+
</ItemGroup>
13+
14+
</Project>

‎authorization-dotnet/AddingCustomClaimsToAccessTokenInDuende/Api/Program.cs‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
using System.Security.Claims;
2+
using Duende.IdentityModel;
3+
using Microsoft.AspNetCore.Authentication.JwtBearer;
4+
5+
var builder = WebApplication.CreateBuilder(args);
6+
7+
builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
8+
.AddJwtBearer(options =>
9+
{
10+
options.Authority = "https://localhost:5001";
11+
options.Audience = "paymentsapi";
12+
options.MapInboundClaims = false;
13+
options.TokenValidationParameters.RoleClaimType = JwtClaimTypes.Role;
14+
});
15+
16+
builder.Services.AddAuthorization();
17+
18+
var app = builder.Build();
19+
20+
app.UseAuthentication();
21+
app.UseAuthorization();
22+
23+
app.MapGet("/discounts", (ClaimsPrincipal user) => new
24+
{
25+
Tenant = user.FindFirstValue("tenant"),
26+
Discount = user.FindFirstValue("payments.discount")
27+
})
28+
.RequireAuthorization(policy => policy.RequireRole("admin"));
29+
30+
app.Run();

‎authorization-dotnet/AddingCustomClaimsToAccessTokenInDuende/Api/Properties/launchSettings.json‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
{
2+
"$schema": "http://json.schemastore.org/launchsettings.json",
3+
"profiles": {
4+
"Api": {
5+
"commandName": "Project",
6+
"dotnetRunMessages": true,
7+
"launchBrowser": false,
8+
"applicationUrl": "https://localhost:5003",
9+
"environmentVariables": {
10+
"ASPNETCORE_ENVIRONMENT": "Development"
11+
}
12+
}
13+
}
14+
}

‎authorization-dotnet/AddingCustomClaimsToAccessTokenInDuende/Api/appsettings.json‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
{
2+
"Logging": {
3+
"LogLevel": {
4+
"Default": "Information",
5+
"Microsoft.AspNetCore": "Warning"
6+
}
7+
},
8+
"AllowedHosts": "*"
9+
}

‎authorization-dotnet/AddingCustomClaimsToAccessTokenInDuende/IdentityServer/Config.cs‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
1-
using Duende.IdentityServer;
1+
using Duende.IdentityModel;
2+
using Duende.IdentityServer;
23
using Duende.IdentityServer.Models;
34

45
namespace IdentityServer;
@@ -18,6 +19,15 @@ public static class Config
1819
new(name: "payments", displayName: "Allow payments", userClaims: new[] { "payments.discount" })
1920
};
2021

22+
public static IEnumerable<ApiResource> ApiResources =>
23+
[
24+
new ApiResource("paymentsapi", "Payments API")
25+
{
26+
Scopes = { "payments" },
27+
UserClaims = { JwtClaimTypes.Role }
28+
}
29+
];
30+
2131
public static IEnumerable<Client> Clients =>
2232
new Client[]
2333
{

‎authorization-dotnet/AddingCustomClaimsToAccessTokenInDuende/IdentityServer/CustomProfileService.cs‎

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
1-
using Duende.IdentityServer.Models;
1+
using Duende.IdentityModel;
2+
using Duende.IdentityServer.Models;
23
using Duende.IdentityServer.Services;
34
using System.Security.Claims;
45
using Duende.IdentityServer.Extensions;
@@ -7,22 +8,26 @@ namespace IdentityServer;
78

89
public sealed class CustomProfileService : IProfileService
910
{
10-
public Task GetProfileDataAsync(ProfileDataRequestContext context)
11+
public Task GetProfileDataAsync(ProfileDataRequestContext context, CancellationToken ct)
1112
{
12-
if (context.Client.ClientId == "web")
13+
if (context.Application?.Identifier == "web")
1314
{
1415
context.IssuedClaims.Add(new Claim("tenant", "main"));
1516
}
1617

1718
if (context.RequestedClaimTypes.Any())
1819
{
19-
context.AddRequestedClaims(new[] { new Claim("payments.discount", "20") });
20+
context.AddRequestedClaims(new[]
21+
{
22+
new Claim("payments.discount", "20"),
23+
new Claim(JwtClaimTypes.Role, "admin")
24+
});
2025
}
2126

2227
return Task.CompletedTask;
2328
}
2429

25-
public Task IsActiveAsync(IsActiveContext context)
30+
public Task IsActiveAsync(IsActiveContext context, CancellationToken ct)
2631
{
2732
if (context.Subject.GetSubjectId() == "3")
2833
{

‎authorization-dotnet/AddingCustomClaimsToAccessTokenInDuende/IdentityServer/HostingExtensions.cs‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
using IdentityServer.Pages;
12
using Serilog;
23

34
namespace IdentityServer;
@@ -9,11 +10,12 @@ public static WebApplication ConfigureServices(this WebApplicationBuilder builde
910

1011
builder.Services.AddIdentityServer(options =>
1112
{
12-
// https://docs.duendesoftware.com/identityserver/v6/fundamentals/resources/api_scopes#authorization-based-on-scopes
13+
// https://docs.duendesoftware.com/identityserver/fundamentals/resources/api-scopes/
1314
options.EmitStaticAudienceClaim = true;
1415
})
1516
.AddInMemoryIdentityResources(Config.IdentityResources)
1617
.AddInMemoryApiScopes(Config.ApiScopes)
18+
.AddInMemoryApiResources(Config.ApiResources)
1719
.AddInMemoryClients(Config.Clients)
1820
.AddTestUsers(TestUsers.Users)
1921
.AddProfileService<CustomProfileService>();

‎authorization-dotnet/AddingCustomClaimsToAccessTokenInDuende/IdentityServer/IdentityServer.csproj‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,12 @@
1-
<Project Sdk="Microsoft.NET.Sdk.Web">
1+
<Project Sdk="Microsoft.NET.Sdk.Web">
22
<PropertyGroup>
3-
<TargetFramework>net8.0</TargetFramework>
3+
<TargetFramework>net10.0</TargetFramework>
44
<ImplicitUsings>enable</ImplicitUsings>
5+
<Nullable>enable</Nullable>
56
</PropertyGroup>
67

78
<ItemGroup>
8-
<PackageReference Include="Duende.IdentityServer" Version="6.3.7" />
9-
<PackageReference Include="Serilog.AspNetCore" Version="8.0.0" />
9+
<PackageReference Include="Duende.IdentityServer" Version="8.0.5" />
10+
<PackageReference Include="Serilog.AspNetCore" Version="10.0.0" />
1011
</ItemGroup>
1112
</Project>

0 commit comments

Comments
 (0)