I have my own IClaimsTransformation where i get user data from my database and based on it i add claim (role). The problem is, when i add a role that isn't in active directory. When i use attirbute [Authorize(Roles = "customRole")] i get "The trust relationship between the primary domain and the trusted domain failed" error after deploying app on IIS and trying to use endpoint that requires custom role. I read that it is caused by checking if user is in role where there is no group with that name in active directory and it seems to really be the case.
IClaimsTransformation:
public class ClaimsTransformer : IClaimsTransformation
{
private readonly IUserManager _userManager;
public ClaimsTransformer(IUserManager userManager)
{
_userManager = userManager;
}
public async Task<ClaimsPrincipal> TransformAsync(ClaimsPrincipal principal)
{
var claiminfo = (ClaimsIdentity)principal.Identity;
string[] domainAndName = claiminfo.Name.Split("\\");
var name = domainAndName[1];
var user = await _userManager.GetUserInfo(name);
if (user.isUser)
{
var userClaim = new Claim(claiminfo.RoleClaimType, "user");
claiminfo.AddClaim(userClaim);
if (user.isAdmin)
{
var adminClaim = new Claim(claiminfo.RoleClaimType, "admin");
claiminfo.AddClaim(adminClaim);
}
}
return principal;
}
}
And then in controller:
[HttpGet]
[Authorize(Roles = "customRole")]
public async Task<ActionResult<IEnumerable<Data>>> Get()
{
var result = await manager.GetAll();
return Ok(result);
}
Username is actually taken from windows authentication but roles are from database.
I don't use active directory groups (roles) for authorization. I just want to set my own custom roles based on data in database and use role names that are not existing in active directory. How can i achieve this?