IIS / ASP.NET - How to Provide ClaimsPrincipal? [closed] - asp.net

Question

Closed. This question needs to be more focused. It is not currently accepting answers.
Want to improve this question? Update the question so it focuses on one problem only by editing this post.
Closed 3 years ago.
Improve this question
I want to have a (.NET Core) web api site. BEFORE a request comes into my site, it has to pass through a secondary site ("gateway"). The gateway will figure out the claims and create an IClaimsPrinciple with custom claims. As far as I am concerned, the gateway can set those claims by magic. My api will trust them 100%.
The gateway will then make its own request to my api, somehow attaching the claims info. When the request gets to my api site, the claims are already set.
How does the gateway site "attach" the claims to the http request?
An analogous (I think) use case is if IIS is set to windows auth. When I examine the static User object in my (unprotected) controller method, I can see it is a WindowsPrincipal, and its claims are things like AD user groups. My code (as far as I know) didn't do anything to the request to add those claims; it seems like IIS altered the request to attach those claims before it got to my site.
Is what I am asking possible? If so, how do you set the principle on a request? Or am I completely misunderstanding how principles are set? In the Windows Auth example, is it something in my .NET Project that's setting the WindowsPrinciple?

Answer 1

Are you asking, "how can I add custom claims to a user from inside an executable after the user has been authenticated but before the user tries to use a protected resource"?
By "protected resource" I mean anything protected with an [Authorize] attribute.
If that is what you are asking, I do not have a .Net Core example, but I do have a .Net Framework example, it is probably pretty easy to translate into .Net Core.
Yes, it is done in the middleware, in the Configuration method of your Startup class. In the example below I'm using Auth0 to do authentication. Below is the entire method, but scroll down to "SecurityTokenValidated" to see an example of adding a claim to an identity. In an actual application you would probably pull some unique key from the identity and then look up claims in a database.
public class Startup
{
public void Configuration(IAppBuilder app)
{
// Configure Auth0 parameters
string auth0Domain = ConfigurationManager.AppSettings["auth0:Domain"];
string auth0ClientId = ConfigurationManager.AppSettings["auth0:ClientId"];
string auth0ClientSecret = ConfigurationManager.AppSettings["auth0:ClientSecret"];
string auth0RedirectUri = ConfigurationManager.AppSettings["auth0:RedirectUri"];
string auth0PostLogoutRedirectUri = ConfigurationManager.AppSettings["auth0:PostLogoutRedirectUri"];
// Enable Kentor Cookie Saver middleware
app.UseKentorOwinCookieSaver();
// Set Cookies as default authentication type
app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);
app.UseCookieAuthentication(new CookieAuthenticationOptions
{
AuthenticationType = CookieAuthenticationDefaults.AuthenticationType,
LoginPath = new PathString("/Account/Login")
});
// Configure Auth0 authentication
app.UseOpenIdConnectAuthentication(new OpenIdConnectAuthenticationOptions
{
AuthenticationType = "Auth0",
Authority = $"https://{auth0Domain}",
ClientId = auth0ClientId,
ClientSecret = auth0ClientSecret,
RedirectUri = auth0RedirectUri,
PostLogoutRedirectUri = auth0PostLogoutRedirectUri,
ResponseType = OpenIdConnectResponseType.CodeIdToken,
Scope = "openid profile",
TokenValidationParameters = new TokenValidationParameters
{
NameClaimType = "name",
RoleClaimType = "http://schemas.microsoft.com/ws/2008/06/identity/claims/role"
},
Notifications = new OpenIdConnectAuthenticationNotifications
{
RedirectToIdentityProvider = notification =>
{
if (notification.ProtocolMessage.RequestType == OpenIdConnectRequestType.Logout)
{
var logoutUri = $"https://{auth0Domain}/v2/logout?client_id={auth0ClientId}";
var postLogoutUri = notification.ProtocolMessage.PostLogoutRedirectUri;
if (!string.IsNullOrEmpty(postLogoutUri))
{
if (postLogoutUri.StartsWith("/"))
{
// transform to absolute
var request = notification.Request;
postLogoutUri = request.Scheme + "://" + request.Host + request.PathBase + postLogoutUri;
}
logoutUri += $"&returnTo={ Uri.EscapeDataString(postLogoutUri)}";
}
notification.Response.Redirect(logoutUri);
notification.HandleResponse();
}
return Task.FromResult(0);
},
//this fires when a user is redirected to Auth0 for authentication.
SecurityTokenValidated = (context) =>
{
var identity = context.AuthenticationTicket.Identity;
var uniqueKey = identity.FindFirst("MyUniqueKey");
//lookup something in database using unique key
identity.AddClaim(new System.Security.Claims.Claim(ClaimTypes.Role, "SomeRole"));
return Task.FromResult(0);
}
}
});
}
}
}