Looping custom claims on login - Asp.net core

Question

Our ASP.NET MVC application connects to IdentityServer 3 with the following config and able to access all the custom claims

app.UseOpenIdConnectAuthentication(new OpenIdConnectAuthenticationOptions
            {
                Authority = IdentityServerUrl,
                ClientId = IdentityClientId,                              
                ResponseType = "id_token token",
                Scope = "openid profile myScope",
                SignInAsAuthenticationType = "Cookies",

                Notifications = new OpenIdConnectAuthenticationNotifications
                {
                    SecurityTokenValidated = async n =>
                    {
                        var newIdentity = new ClaimsIdentity(
                            n.AuthenticationTicket.Identity.AuthenticationType,
                            "name",
                            "myrole");

                        var userInfoClient = new UserInfoClient(
                            new Uri(n.Options.Authority + "/connect/userinfo"),
                            n.ProtocolMessage.AccessToken);

                        var userInfo = await userInfoClient.GetAsync();
                        userInfo.Claims.ToList().ForEach(ui => newIdentity.AddClaim(new Claim(ui.Item1, ui.Item2)));

                        var sid = n.AuthenticationTicket.Identity.Claims.FirstOrDefault(x => x.Type == "sid");
                        if (sid != null)
                        {
                            newIdentity.AddClaim(new Claim("sid", sid.Value));
                        }

                        n.AuthenticationTicket = new AuthenticationTicket(
                            newIdentity,
                            n.AuthenticationTicket.Properties);
                    }
                }
            });

Now we want to upgrade and connect to IdentityServer 3 with .net core

We tried below code but I am not getting the sure how to loop through all the custom claims

.AddOpenIdConnect("oidc", options =>
                {
                    options.Authority = IdentityClientUrl;
                    options.ClientId = IdentityClientId;
                    options.ResponseType = OpenIdConnectResponseType.IdTokenToken;
                    options.Scope.Clear();
                    options.Scope.Add("profile");
                    options.Scope.Add("openid");
                    options.Scope.Add("email");
                    options.Scope.Add("myScope");

                    options.GetClaimsFromUserInfoEndpoint = true;

                    options.TokenValidationParameters = new TokenValidationParameters
                    {
                        NameClaimType = "name",
                        RoleClaimType = "myrole"
                    };

                    options.SaveTokens = true;
                    options.ClaimActions.MapUniqueJsonKey("myrole", "myrole", "string");          
                });

In the existing approach, i am able to get all the claims from userInfo, so I can loop and add everything. In the asp.net core - however I can map them using ClaimActions, eachone at a time. Is there any way I can loop throug all of them and add all of them - say I don't know the claimType!

Any help please?

Answer 1

You can try this to map all the claims using the MapAllExcept method, like:

options.ClaimActions.MapAllExcept("iss", "nbf", "exp", "aud", "nonce");

To complement this answer, I wrote a blog post that goes into more detail about this topic: Debugging OpenID Connect claim problems in ASP.NET Core