Role Claim not working in ASP.NET Core 8 Web API after upgrading to .NET 8

Question

I have a .NET 7 ASP.NET Core 7.0 Web API project which uses .NET 7 ASP.NET Core 7.0 IdentityServer4 Project. Everything is working fine.

Here is my code setup:

IdentityServer4:

In my ProfileService in IdentityServer4 project, I'm adding a role claim as show below.

ProfileService.cs:

claims.Add(new Claim("role", "master"));

Startup.cs:

JwtSecurityTokenHandler.DefaultInboundClaimTypeMap.Clear();

Web API:

I have added Authorization services in Program.cs

Program.cs:

JwtSecurityTokenHandler.DefaultInboundClaimTypeMap.Clear();

services.AddScoped<IAuthorizationHandler, SubjectMustMatchUserHandler>();

services.AddAuthorization(authorizationOptions =>
            {
                authorizationOptions.AddPolicy(
                Policies.SubjectMustMatchUser,
                policyBuilder =>
                {
                    policyBuilder.RequireAuthenticatedUser();
                    policyBuilder.AddRequirements(new SubjectMustMatchUserRequirement());
                });

                authorizationOptions.AddPolicy(Policies.MustBeMasterUser, Policies.MustBeMasterUserPolicy());
            })
        .AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
        .AddJwtBearer(options =>
        {
            options.Authority = configuration.GetValue<string>("AuthorityUrl");
            options.Audience = "redacted";
        });

Authorization Policy:

public static AuthorizationPolicy MustBeMasterUserPolicy()
{
    return new AuthorizationPolicyBuilder()
        .RequireAuthenticatedUser()
        .RequireClaim("role", "master")
        .Build();
}

Claims:

Till now all is working fine.

Now I have updated my project to .NET 8 and the Role Claim is not working as expected and my policies are failing.

When I debug, I noticed the change in the name of role claim key from role to http://schemas.microsoft.com/ws/2008/06/identity/claims/role as shown below

This change is making my policies to fail. I'm not able to find any docs to fix this in Migration guides. Please can you help me figure out what I'm missing?

see my blog post here nestenius.se/2023/06/02/…

Tore Nestenius
– Tore Nestenius

2023-11-25 19:41:11 +00:00
Commented Nov 25, 2023 at 19:41 — Tore Nestenius
– Tore Nestenius, Commented Nov 25, 2023 at 19:41

Tore Nestenius · Accepted Answer · 2023-11-25 19:42:46Z

5

You need to specify what the name of your role and name claim is, using:

.AddJwtBearer(opt =>
{
    // ...
    opt.TokenValidationParameters.RoleClaimType = "role";
    opt.TokenValidationParameters.NameClaimType = "name";
    // ...
});

You might also want to disable the rename of the claims, by:

.AddJwtBearer(opt =>
{
    // ...
    opt.MapInboundClaims = false;
    // ...
});

For more details, see my blog post here: Debugging JwtBearer Claim Problems in ASP.NET Core

answered Nov 25, 2023 at 19:42

Tore Nestenius

20.4k5 gold badges36 silver badges48 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

fingers10 Over a year ago

Is this something newly changes in .NET 8? because my code worked with .NET 7 I'm reading and testing this. Will upvote once I complete my analysis.

Tore Nestenius Over a year ago

I am not sure about about that.

Wayne Thompson · Accepted Answer · 2024-02-23 03:43:28Z

1

We already had the TokenValidationParameters set so that did not help.

It works if I use the full claim name as follows.

options.AddPolicy(AccountDefaults.AdminPolicy, p => p.RequireAuthenticatedUser().RequireClaim(//JwtClaimTypes.Role
"http://schemas.microsoft.com/ws/2008/06/identity/claims/role", AccountDefaults.Administrator));

We then realised that we can use

ClaimTypes.Role

Resulting in

options.AddPolicy(AccountDefaults.AdminPolicy, p => p.RequireAuthenticatedUser().RequireClaim(ClaimTypes.Role, AccountDefaults.Administrator));

answered Feb 23, 2024 at 3:43

Wayne Thompson

214 bronze badges

Collectives™ on Stack Overflow

Role Claim not working in ASP.NET Core 8 Web API after upgrading to .NET 8

2 Answers 2

2 Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related