Search code examples
asp.netasp.net-coreopeniddict

Handling logging into SPA application: getting user info, managing claims

Context:

I've implemented OpenIddict in my application, basing on GitHub readme. I currently use TokenEndpoint to log user in. 

services.AddOpenIddict<ApplicationUser, UsersDbContext>().EnableTokenEndpoint("/api/Account/Login")

Although calling /api/Account/Info works and it returns token in response, I need to get some basic data about logged in user (username, email, account type). Response from token endpoint doesn't provide that.

I've found something like UserinfoEndpoint:

.EnableUserinfoEndpoint("/api/Account/Info")

But what I see after in http response is:

{
  "sub": "ea2248b4-a[...]70757de60fd",
  "iss": "http://localhost:59381/"
}

This should return me some Claims. As it doesn't return anything, I assume that no Identity Claims were created during token generation.

What I need to know in a nutshell:

  1. Is using Token Endpoint correct way to log in user?
  2. Do I need to generate Claims by myself?
  3. Can I control Claims by myself and how?
  4. How to make some Claims visible through UserInfoEndpoint?
Solution

  • Is using Token Endpoint correct way to log in user?

    Yep.

    Do I need to generate Claims by myself?

    The userinfo endpoint simply exposes the tokens stored in the access token (which is something that may change in the future).

    Can I control Claims by myself and how? How to make some Claims visible through UserInfoEndpoint?

    To allow the userinfo endpoint to return more claims, you'll have to request more scopes. Read http://openid.net/specs/openid-connect-core-1_0.html#ScopeClaims for more information.

    In a future version, we may allow you to return custom claims, but it's not currently supported.