8

At my shop we have a couple .NET Web APIs that use OAuth tokens for authentication. Currently, each web API is both authorization and resource server. Users authenticate to all of these APIs using the same credential, but they currently need to authenticate to each API independently.

I am interested in creating a shared authorization server (a la http://bitoftech.net/2014/10/27/json-web-token-asp-net-web-api-2-jwt-owin-authorization-server/), but I'm getting hung up on claims transformation. It is highly useful to us to be able to add custom claims (specific to the application) to the token that gets issued, along the lines of the following example: 

public override Task GrantResourceOwnerCredentials(OAuthGrantResourceOwnerCredentialsContext context)
{

    /* validate credentials here... */

    var identity = new ClaimsIdentity("JWT");

    identity.AddClaim(new Claim(ClaimTypes.Name, context.UserName));
    identity.AddClaim(new Claim("sub", context.UserName));
    identity.AddClaim(new Claim(ClaimTypes.Role, "Manager"));
    identity.AddClaim(new Claim(ClaimTypes.Role, "Supervisor"));

    var props = new AuthenticationProperties(new Dictionary<string, string>
        {
            {
                 "audience", (context.ClientId == null) ? string.Empty : context.ClientId
            }
        });

    var ticket = new AuthenticationTicket(identity, props);
    context.Validated(ticket);
    return Task.FromResult<object>(null);
}

From what I can see, if I create a common Authorization server, all claims transformation needs to happen there. Does this mean that the resource servers (our different Web APIs) can't add any custom claims to the user's token? Can I add claims specific to the application requesting the token on the Authorization server - or do I need to rig up something so that the authorization server adds certain claims based on the requesting app?

Improve this question
2
  • For any future viewers of this question, I never found a solution for the consuming resource to add custom claims. I ended up writing an authorization server that would accept a common configuration for each resource server and generate custom claims based on that.
    – Joshua Barron
    Mar 20, 2015 at 15:46
  • Seems like you would need to have your claims managed in a central database and then populated when the token was issued. OAuth by itself is really only authentication/token-issuance. Authorization is still a piece you have to plug in (claims, roles, etc.) and manage separately.
    – Kasey Speakman
    Oct 19, 2015 at 16:52

1 Answer 1

Reset to default
1

In the past I've had one authentication server that issued tokens. Then the client sent the authentication token to an authorization server with a request of the form:

"The client with this application_id is requesting access for the user defined in the attached authentication token to access content X."

The authorization server checked to make sure the user was authorized and issued a new authorization token to the client. The client then passed this token to the service that provided content X.

The authorization server in this case did need a configuration update to know about new content Y.

You could modify it so the resource servers ask the authorization server to create a token containing attached custom claims.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.