Add persistent claim with Asp.Net Core Identity

Question

I have build custom authorization module based on Identity. Permissions from db are loaded to Claims with UserClaimsPrincipalFactory which works great but happens only on login.

When granting new permission I think I have two options:

Add claim to current ClaimsIdentity
Refresh all claims by recreating identity

The problem is when i try to add claim with user.Identity.AddClaim() it doesn't persist when page is reloaded. And I cannot find information how to reload ClaimsIdentity.

the identity is recreated per request. why can't you store the new claim? — Daniel A. White
– Daniel A. White, Commented Feb 22, 2021 at 21:23
user.Identity.AddClaim() is just a method to add claim on ClaimsIdentity which is of course not related to Identity, what you need is UserManager.AddClaimAsync which should persist your claim. — King King
– King King, Commented Feb 22, 2021 at 21:31
@KingKing UserManager just saves claim in db I don't want that. I am using UserClaimsPrincipalFactory (learn.microsoft.com/en-us/dotnet/api/…) to generate claims dynamically but methods in it CreateAsync and GenerateClaimsAsync are only called on sign in. — Szel
– Szel, Commented Feb 22, 2021 at 22:52

Karney. · Accepted Answer · 2021-02-23 09:51:10Z

3

I am not sure when project need to add the external claims. Identity is based on cookie, every request will carry the cookie, so the identity can parse the cookie as the claims. If you want to reload ClaimsIdentity, you need to reuse the method SignInAsync to regenerate cookie. But there is a global method IClaimsTransformation can help you add the temporary claim according to different situation.

public class Tanstromer : IClaimsTransformation
{
    public Task<ClaimsPrincipal> TransformAsync(ClaimsPrincipal principal)
    {
        var claims = new List<Claim> { };
        var identity = principal.Identity as ClaimsIdentity;
        identity.AddClaim(new Claim("",""));

        //you can add some justification here
        var userPrinicpal = new ClaimsPrincipal(identity);
        return Task.FromResult(principal); 
    }
}

Add it in ConfigureService

services.AddScoped<IClaimsTransformation, Tanstromer>();

answered Feb 23, 2021 at 9:51

Karney.

5,0812 gold badges10 silver badges11 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Szel Over a year ago

Thanks, I moved my logic from UserClaimsPrincipalFactory to IClaimsTransformation.

arthur Over a year ago

this is good solution but how can I call the TransformAsync metot another class?

David Klempfner Over a year ago

Why is your class called Tanstromer?

Denny Jacob · Accepted Answer · 2023-02-14 13:49:09Z

0

"I am not sure when project need to add the external claims."

Apps that rely on 3rd party authentication will need to add additional app specific claims to the principal that is created. I have used TransformAsync() in those scenarios and had the same challenge with persisting the "appended" claims in certain situations.

answered Feb 14, 2023 at 13:49

Denny Jacob

3954 silver badges9 bronze badges

Collectives™ on Stack Overflow

Add persistent claim with Asp.Net Core Identity

2 Answers 2

3 Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

3 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related