At my shop we have a couple .NET Web APIs that use OAuth tokens for authentication. Currently, each web API is both authorization and resource server. Users authenticate to all of these APIs using the same credential, but they currently need to authenticate to each API independently.
I am interested in creating a shared authorization server (a la http://bitoftech.net/2014/10/27/json-web-token-asp-net-web-api-2-jwt-owin-authorization-server/), but I'm getting hung up on claims transformation. It is highly useful to us to be able to add custom claims (specific to the application) to the token that gets issued, along the lines of the following example:
public override Task GrantResourceOwnerCredentials(OAuthGrantResourceOwnerCredentialsContext context)
{
/* validate credentials here... */
var identity = new ClaimsIdentity("JWT");
identity.AddClaim(new Claim(ClaimTypes.Name, context.UserName));
identity.AddClaim(new Claim("sub", context.UserName));
identity.AddClaim(new Claim(ClaimTypes.Role, "Manager"));
identity.AddClaim(new Claim(ClaimTypes.Role, "Supervisor"));
var props = new AuthenticationProperties(new Dictionary<string, string>
{
{
"audience", (context.ClientId == null) ? string.Empty : context.ClientId
}
});
var ticket = new AuthenticationTicket(identity, props);
context.Validated(ticket);
return Task.FromResult<object>(null);
}
From what I can see, if I create a common Authorization server, all claims transformation needs to happen there. Does this mean that the resource servers (our different Web APIs) can't add any custom claims to the user's token? Can I add claims specific to the application requesting the token on the Authorization server - or do I need to rig up something so that the authorization server adds certain claims based on the requesting app?