Kentor Auth Services - Additional Claim
I am evaluating Kentor auth services (its OWIN version) for user authentication using SAML. Now I would like to submit an additional application for the service. Along with the samples, I was able to submit a service request and debug it.
I made a custom ClaimAuthenticationManager and there I see additional claims coming to the auth service. But later on (the Kendor examples have a home / index view that lists all the claims), this claim is no longer available. Does anyone have an idea what I am doing wrong?
Thank you so much!
source to share
When using AuthServices (or any external login) along with an ASP.NET Identity, inbound claims are only used to find the ASP.NET Identity user in the database. Then the incoming user is then dropped completely and the user from ASP.NET ID is loaded and used
In the MVC5 template, by default, the transition from external identity to ASP.NET identity is done in AccountController.ExternalLoginCallback()
. To save the incoming information, you need to configure this method. There are two options.
1. Update the saved user in ExternalLoginCallback()
// Sign in the user with this external login provider if the user already has a login
var user = await UserManager.FindAsync(loginInfo.Login);
if (user != null)
{
// Update user with info from external identity and save.
user.GivenName = loginInfo.ExternalIdentity.FindFirst(ClaimTypes.GivenName).Value;
await UserManager.UpdateAsync(user);
await SignInAsync(user, isPersistent: false);
return RedirectToLocal(returnUrl);
}
2. Use incoming tickets only for the current session.
Copy the content SignInAsync()
to the method ExternalLoginCallback()
. Extract the call user.GenerateUserIdentityAsync () to a separate line and. Add claims before calling
SignInAsync () `
// Sign in the user with this external login provider if the user already has a login
var user = await UserManager.FindAsync(loginInfo.Login);
if (user != null)
{
AuthenticationManager.SignOut(DefaultAuthenticationTypes.ExternalCookie);
var identity = await user.GenerateUserIdentityAsync(UserManager);
identity.AddClaim(loginInfo.ExternalIdentity.FindFirst(ClaimTypes.GivenName));
AuthenticationManager.SignIn(new AuthenticationProperties() { IsPersistent = isPersistent },
identity);
return RedirectToLocal(returnUrl);
}
Sentence
It is also possible to use external login without ASP.NET ID . If you only use Idp and other login methods that are probably easier to work with.
source to share