1

In OpenIddict 3.1.1 I would like to understand what is the recommended way to modify the TokenValidationParameters when validating the token to map the NameClaimType to the Subject claim.

I am upgrading from OpenIddict version 2 to 3.1.1. I had configured things in our solution that used OpenIddict version 2 to use JWT tokens as shown in the OpenIddict samples project. That project has code as shown here:

            // If you prefer using JWT, don't forget to disable the automatic
            // JWT -> WS-Federation claims mapping used by the JWT middleware:
            
             JwtSecurityTokenHandler.DefaultInboundClaimTypeMap.Clear();
             JwtSecurityTokenHandler.DefaultOutboundClaimTypeMap.Clear();
            
             app.UseJwtBearerAuthentication(new JwtBearerOptions
             {
                 Authority = "http://localhost:52698/",
                 Audience = "resource_server",
                 RequireHttpsMetadata = false,
                 TokenValidationParameters = new TokenValidationParameters
                 {
                     NameClaimType = OpenIdConnectConstants.Claims.Subject,
                     RoleClaimType = OpenIdConnectConstants.Claims.Role
                 }
            });

Notice the line NameClaimType = OpenIdConnectConstants.Claims.Subject,

Now in all my .NET controllers when I refer to User.Identity.Name the value is the sub claim which maps to my Identity User Id value, which is the behaviour that I want.

I understand that JWT token support is configured as the default in Open Iddict 3.1.1 now, and the migration guide recommends upgrading to the OpenIddict validation handler. After following the migration guide to upgrade to version 3.1.1, my User.Identity.Name value is now mapped to my username, instead of the sub claim. (This breaks a lot of my server side functionality)

What is the recommended way in OpenIddict 3.1.1 to modify the TokenValidationParameters to map the NameClaimType to the sub claim?

Update

I haven't been able to figure out how to configure this. Looking at the source it seems like this is not configurable - inside the OpenIddictValidationOptions.cs class I see this code:

     {
     AuthenticationType=TokenValidationParameters.DefaultAuthenticationType,
     ClockSkew = TimeSpan.Zero,
     NameClaimType = Claims.Name,
     RoleClaimType = Claims.Role,

It doesn't seem like the NameClaimType is overridable - this is where it is assigned to the "name" claim.

So I will update my controller endpoints to fetch the UserId sub claim in a different way.

I guess the question I have is, why in the OpenIddict samples did the JWT token have to be validated with the "sub" claim and in the new version it uses the "name" claim?

1 Answer 1

0

Do this:

builder.Services.AddOpenIddict()
    .AddValidation(options =>
    {
        options.Configure(opt2 => {
            opt2.TokenValidationParameters.NameClaimType= "sub";
        });
    });

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.