Can't get email user claims from Identity Server 4

Question

I use Identity Server 4 and Swagger in my microservice to authorize. So, I have this configuration on IS side:

   public static IEnumerable ApiScopes =>
        new List()
        {
            new ApiScope("PetAPI", "Pets WebAPI"),
            new ApiScope("NotificationsAPI", "Notifications WebAPI"),
            new ApiScope("ScheduleAPI","Schedule WebAPI")
        };

    public static IEnumerable IdentityResources =>
        new List()
        {
            new IdentityResources.OpenId(),
            new IdentityResources.Email(),
            new IdentityResources.Profile()
        };

    public static IEnumerable ApiResources =>
        new List()
        {
            new ApiResource("PetAPI"),
            new ApiResource("NotificationsAPI"),
            new ApiResource("ScheduleAPI")
        };

    public static IEnumerable Clients =>
        new List()
        {
            new Client()
            {
               ClientId = "pmcs-client-id",
               ClientSecrets = { new Secret("client_secret".ToSha256()) },
               ClientName = "M2M Client",
               AllowedGrantTypes = GrantTypes.ClientCredentials,
               AllowedScopes = {
                   IdentityServerConstants.StandardScopes.OpenId,
                   IdentityServerConstants.StandardScopes.Profile,
                   IdentityServerConstants.StandardScopes.Email,
                   "PetAPI",
                   "NotificationsAPI",
                   "ScheduleAPI"
               }
            },
            new Client()
            {
                ClientId = "swagger-client-id",
                ClientSecrets = { new Secret("client_secret".ToSha256()) },
                ClientName = "Swagger Client",
                AllowedGrantTypes = GrantTypes.ResourceOwnerPassword,
                AllowedScopes = {
                    IdentityServerConstants.StandardScopes.OpenId,
                    IdentityServerConstants.StandardScopes.Email,
                    IdentityServerConstants.StandardScopes.Profile,
                    "PetAPI",
                    "NotificationsAPI",
                    "ScheduleAPI"
                }
            }
        };

And configuration on microservice side:

services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme).AddJwtBearer(options =>
            {
                options.Authority = AuthConfiguration.Authority;
                options.RequireHttpsMetadata = AuthConfiguration.RequireHttpsMetadata;
                options.Audience = AuthConfiguration.Audience;
                options.TokenValidationParameters = new TokenValidationParameters
                {
                    ValidateAudience = AuthConfiguration.ValidateAudience,
                };
            })
                .AddOpenIdConnect(OpenIdConnectDefaults.AuthenticationScheme, config =>
            {
                config.Authority = AuthConfiguration.Authority;
                config.ClientId = AuthConfiguration.SwaggerClientId;
                config.ClientSecret = AuthConfiguration.ClientSecret;
                config.SaveTokens = true;
                config.ResponseType = "id_token";
                config.TokenValidationParameters = new TokenValidationParameters
                {
                    ValidateAudience = AuthConfiguration.ValidateAudience
                };

                config.Scope.Add(AuthConfiguration.ScheduleScope);
                config.Scope.Add("email");
                config.Scope.Add("openid");
                config.Scope.Add("profile");

                config.GetClaimsFromUserInfoEndpoint = true;
                config.ClaimActions.MapAll();
            });

The method I use to get claims:

var emailFromClaims = _context.HttpContext?.User?.FindFirst(ClaimTypes.Email)?.Value;

It seems that I have this claim in my Id token, but they aren't mapped into user claims. I really can't understand what's wrong and I'll be exremely grateful if anyone could help me to find a solution.

Link to pull request where I came across this problem: https://github.com/nantonov/PMCS/pull/58

Tore Nestenius · Answer

By default only a few claims are mapped into the ClaimsPrincipal user object.

You need to manually map the remaining claims that you want to end up in the user object, using:

.AddOpenIdConnect(options =>
{
   ...
   options.ClaimActions.MapUniqueJsonKey("preferred_username", "preferred_username");
   options.ClaimActions.MapUniqueJsonKey("email", "email");
});

see https://docs.microsoft.com/en-us/aspnet/core/security/authentication/claims?view=aspnetcore-6.0 for more details.

Aviad P. · Answer

You are trying to access identity resource claims from the JWT token, they are not automatically included.

Only claims associated with API resources are included in the JWT token. If you want to include the email claim as well, you have to add it as a user claim to the API resource. Modify your API resource definitions as such:

new List()
{
    new ApiResource("PetAPI") {
        UserClaims = { "email" }
    },
    new ApiResource("NotificationsAPI") {
        UserClaims = { "email" }
    },
    new ApiResource("ScheduleAPI") {
        UserClaims = { "email" }
    }
};

Can't get email user claims from Identity Server 4

2 Answers