CODEWITHSUNDEEP
identityserver3identityserver4thinktecture-ident-serverthinktecture
Sabby62
Sabby62

Reputation: 1717

Adding Application Specific claim after Web API Authentication (Identity Server)

I am adding application specific claims in my Web Application OnValidateIdentity to Identity Sever's access token claims. I am grabbing the application specific claims for the logged in user querying the Database for every API call. Should I make the application specific claims to be injected in the token in Identity Server (to reduce the DB calls)?

Upvotes: 0

Views: 343

Answers (1)

rawel
rawel

Reputation: 3033

Identity Server Token should only contain claims about the user. It should be ok to query the application specific claims when the token received. You can introduce a caching layer to reduce DB calls if that is a concern.

But if you have really valid reason these rules can be broken and add application-specific claims at identity server. (e.g: settings shared by multiple apps).

Upvotes: 1

Related Questions