How to pass custom claims through ASP.NET Identity FacebookAuthenticationProvider?

Question

Starting with the Visual Studio Web API project template, I’m trying to add custom claims to the token created by the /Api/Account/ExternalLogin endpoint. I add them via the FacebookAuthenticationProvider.OnAuthenticated callback, but they are not saved until OAuthAuthorizationServerProvider.AuthorizationEndpointResponse() .

Note. I use a similar approach described by Rahul Nath in an ASP.NET Web API article and External Login - Social Network Authentication

the code

In my Startup.Auth.cs class class ConfigureAuth() method (which is called from the OwinStartup class Configuration() method), I added a callback function to the OnAuthenticated property to set one requirement, foo , with a value of bar :

  var facebookAuthenticationProvider = new FacebookAuthenticationProvider() { OnAuthenticated = (context) => { context.Identity.AddClaim(new Claim("foo", "bar")); return Task.FromResult(0); } }; 

Then I add the FacebookAuthenticationProvider instance to the new FacebookAuthenticationOptions object:

  var facebookAuthenticationOptions = new FacebookAuthenticationOptions() { AppId = "XXXX", AppSecret = "YYYY", Provider = facebookAuthenticationProvider }; 

And pass this to the OWIN UseFacebookAuthentication() method:

  app.UseFacebookAuthentication(facebookAuthenticationOptions); 

results

If I set a breakpoint in the OnAuthenticated , I see that my user claim is being added, as well as a number of other statements (including a couple from the urn:facebook namespace). So far so good.

When I check my claims using the AuthorizationEndpointResponse() method of my OAuthAuthorizationServerProvider class after Facebook authentication, however, there are only two claims in the context.Identity.Claims collection:

• http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier
• http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

All claims urn:facebook have been removed, as well as my usual claim foo . I assume that some other place in the pipeline is to recreate a claim using the barebone claims set, but I'm not sure where.

Thoughts?

Answer 1

I have the following code to access user requirements:

  public class AppUser : ClaimsPrincipal{ public AppUser(ClaimsPrincipal principal): base(principal){} public string Role{ get{ return this.FindFirst(ClaimTypes.Role).Value; } } public string ProfileID{ get{ return this.FindFirst("ProfileID").Value; } } } 

Answer 2

You probably need to edit the private ExternalLoginData class to include the additional requirements that you want to pass through the stream. In VS2013 template class files, by default, this private class can be found in the AccountController.cs file.

I had a similar problem, I was not able to send an email from Google's claims, and this solved the problem (note the added variable "Email" and refers to it in both methods:

 private class ExternalLoginData { public string LoginProvider { get; set; } public string ProviderKey { get; set; } public string UserName { get; set; } public string Email { get; set; } public IList<Claim> GetClaims() { IList<Claim> claims = new List<Claim>(); claims.Add(new Claim(ClaimTypes.NameIdentifier, ProviderKey, null, LoginProvider)); if (UserName != null) { claims.Add(new Claim(ClaimTypes.Name, UserName, null, LoginProvider)); } if (Email != null) { claims.Add(new Claim(ClaimTypes.Email, Email, null, LoginProvider)); } return claims; } public static ExternalLoginData FromIdentity(ClaimsIdentity identity) { if (identity == null) { return null; } Claim providerKeyClaim = identity.FindFirst(ClaimTypes.NameIdentifier); if (providerKeyClaim == null || String.IsNullOrEmpty(providerKeyClaim.Issuer) || String.IsNullOrEmpty(providerKeyClaim.Value)) { return null; } if (providerKeyClaim.Issuer == ClaimsIdentity.DefaultIssuer) { return null; } return new ExternalLoginData { LoginProvider = providerKeyClaim.Issuer, ProviderKey = providerKeyClaim.Value, UserName = identity.FindFirstValue(ClaimTypes.Name), Email = identity.FindFirstValue(ClaimTypes.Email) }; } }