Asp.Net Core | Extend windows auth identity object

Question

I want to use Windows Auth in my intranet application, but I need to extend the identity object to get some extra data. As of now, I only have access to the domain name in the identity user. I tried to implement my own user/role store in order to intercept the authorization calls then use the domain name to go to our database and grab the extra data. I implemented my own store, but none of the methods seem to be called. How do I intercept when the app authorized the window user so that I can go to our database and grab what I need to put in the user object?

Here's my Startup.cs

public void ConfigureServices(IServiceCollection services)
{
    services.Configure<CookiePolicyOptions>(options =>
    {
        // This lambda determines whether user consent for non-essential cookies is needed for a given request.
        options.CheckConsentNeeded = context => true;
        options.MinimumSameSitePolicy = SameSiteMode.None;
    });

    services.AddAuthentication(IISDefaults.AuthenticationScheme);
    services.AddIdentity<MyUser, IdentityRole>()
         .AddUserStore<MyUserStore>()
         .AddRoleStore<MyRoleStore>()
         .AddDefaultTokenProviders();

    services.AddMvc().SetCompatibilityVersion(CompatibilityVersion.Version_2_1);
}

public void Configure(IApplicationBuilder app, IHostingEnvironment env)
{
    if (env.IsDevelopment())
    {
        app.UseDeveloperExceptionPage();
    }
    else
    {
        app.UseExceptionHandler("/Error");
        app.UseHsts();
    }

    app.UseAuthentication();
    app.UseHttpsRedirection();
    app.UseStaticFiles();
    app.UseCookiePolicy();

    app.UseMvc();
}

Answer 1

What I did was deleting the basic authentication from MVC and added my AuthenticationHandler which extends the AuthenticationService because I don't want to reinvent every method from IAuthenticationService so:

public void ConfigureServices(IServiceCollection services)
{
    services.Configure<CookiePolicyOptions>(options =>
    {
        // This lambda determines whether user consent for non-essential cookies is needed for a given request.
        options.CheckConsentNeeded = context => true;
        options.MinimumSameSitePolicy = SameSiteMode.None;
    });

services.AddAuthentication(IISDefaults.AuthenticationScheme);
services.AddIdentity<MyUser, IdentityRole>()
     .AddUserStore<MyUserStore>()
     .AddRoleStore<MyRoleStore>()
     .AddDefaultTokenProviders();

services.Remove(services.FirstOrDefault(x => x.ServiceType == typeof(IAuthenticationService)));
services.Add(new ServiceDescriptor(typeof(IAuthenticationService),typeof(AuthenticationHandler), ServiceLifetime.Scoped));

services.AddMvc().SetCompatibilityVersion(CompatibilityVersion.Version_2_1);
}

And then

public class AuthenticationHandler : AuthenticationService
    {
        private readonly ILdapRepository _ldapRepository;
        public AuthenticationHandler(ILdapRepository ldapRepository,
            IAuthenticationSchemeProvider schemes, IAuthenticationHandlerProvider handlers,
            IClaimsTransformation transform) : base(schemes, handlers, transform)
        {
            _ldapRepository = ldapRepository;
        }
        public async override Task<AuthenticateResult> AuthenticateAsync(HttpContext context, string scheme)
        {
            var idk = await base.AuthenticateAsync(context, scheme);
            if (idk.Succeeded) {
                var claims = _ldapRepository.LoadClaimsFromActiveDirectory(idk.Principal.Claims.FirstOrDefault(x => x.Type == CustomClaimTypes.Name)?.Value);
                idk.Principal.AddIdentity(claims);
            }
            return idk;
        }
}

LdapRepository is nothing else as the DirectoryEntry and DirectorySearcher for active directory class.

I hope this helps you.