Update the server samples to add a "preferred_username" claim to iden…

…tity tokens
openiddict · Jan 23, 2024 · 2ed4735 · 2ed4735
1 parent e44fce3
commit 2ed4735
Show file tree

Hide file tree

Showing 15 changed files with 56 additions and 13 deletions.
diff --git a/samples/Balosar/Balosar.Server/Controllers/AuthenticationController.cs b/samples/Balosar/Balosar.Server/Controllers/AuthenticationController.cs
@@ -54,7 +54,10 @@ public async Task<ActionResult> LogInCallback()
         }
 
         // Build an identity based on the external claims and that will be used to create the authentication cookie.
-        var identity = new ClaimsIdentity(authenticationType: "ExternalLogin");
+        var identity = new ClaimsIdentity(
+            authenticationType: "ExternalLogin",
+            nameType: ClaimTypes.Name,
+            roleType: ClaimTypes.Role);
 
         // By default, OpenIddict will automatically try to map the email/name and name identifier claims from
         // their standard OpenID Connect or provider-specific equivalent, if available. If needed, additional

diff --git a/samples/Balosar/Balosar.Server/Controllers/AuthorizationController.cs b/samples/Balosar/Balosar.Server/Controllers/AuthorizationController.cs
@@ -141,6 +141,7 @@ public async Task<IActionResult> Authorize()
                 identity.SetClaim(Claims.Subject, await _userManager.GetUserIdAsync(user))
                         .SetClaim(Claims.Email, await _userManager.GetEmailAsync(user))
                         .SetClaim(Claims.Name, await _userManager.GetUserNameAsync(user))
+                        .SetClaim(Claims.PreferredUsername, await _userManager.GetUserNameAsync(user))
                         .SetClaims(Claims.Role, (await _userManager.GetRolesAsync(user)).ToImmutableArray());
 
                 // Note: in this sample, the granted scopes match the requested scope
@@ -234,6 +235,7 @@ public async Task<IActionResult> Accept()
         identity.SetClaim(Claims.Subject, await _userManager.GetUserIdAsync(user))
                 .SetClaim(Claims.Email, await _userManager.GetEmailAsync(user))
                 .SetClaim(Claims.Name, await _userManager.GetUserNameAsync(user))
+                .SetClaim(Claims.PreferredUsername, await _userManager.GetUserNameAsync(user))
                 .SetClaims(Claims.Role, (await _userManager.GetRolesAsync(user)).ToImmutableArray());
 
         // Note: in this sample, the granted scopes match the requested scope
@@ -333,6 +335,7 @@ public async Task<IActionResult> Exchange()
             identity.SetClaim(Claims.Subject, await _userManager.GetUserIdAsync(user))
                     .SetClaim(Claims.Email, await _userManager.GetEmailAsync(user))
                     .SetClaim(Claims.Name, await _userManager.GetUserNameAsync(user))
+                    .SetClaim(Claims.PreferredUsername, await _userManager.GetUserNameAsync(user))
                     .SetClaims(Claims.Role, (await _userManager.GetRolesAsync(user)).ToImmutableArray());
 
             identity.SetDestinations(GetDestinations);
@@ -352,7 +355,7 @@ private static IEnumerable<string> GetDestinations(Claim claim)
 
         switch (claim.Type)
         {
-            case Claims.Name:
+            case Claims.Name or Claims.PreferredUsername:
                 yield return Destinations.AccessToken;
 
                 if (claim.Subject.HasScope(Scopes.Profile))

diff --git a/samples/Dantooine/Dantooine.Server/Controllers/AuthorizationController.cs b/samples/Dantooine/Dantooine.Server/Controllers/AuthorizationController.cs
@@ -141,6 +141,7 @@ public async Task<IActionResult> Authorize()
                 identity.SetClaim(Claims.Subject, await _userManager.GetUserIdAsync(user))
                         .SetClaim(Claims.Email, await _userManager.GetEmailAsync(user))
                         .SetClaim(Claims.Name, await _userManager.GetUserNameAsync(user))
+                        .SetClaim(Claims.PreferredUsername, await _userManager.GetUserNameAsync(user))
                         .SetClaims(Claims.Role, (await _userManager.GetRolesAsync(user)).ToImmutableArray());
 
                 // Note: in this sample, the granted scopes match the requested scope
@@ -234,6 +235,7 @@ public async Task<IActionResult> Accept()
         identity.SetClaim(Claims.Subject, await _userManager.GetUserIdAsync(user))
                 .SetClaim(Claims.Email, await _userManager.GetEmailAsync(user))
                 .SetClaim(Claims.Name, await _userManager.GetUserNameAsync(user))
+                .SetClaim(Claims.PreferredUsername, await _userManager.GetUserNameAsync(user))
                 .SetClaims(Claims.Role, (await _userManager.GetRolesAsync(user)).ToImmutableArray());
 
         // Note: in this sample, the granted scopes match the requested scope
@@ -333,6 +335,7 @@ public async Task<IActionResult> Exchange()
             identity.SetClaim(Claims.Subject, await _userManager.GetUserIdAsync(user))
                     .SetClaim(Claims.Email, await _userManager.GetEmailAsync(user))
                     .SetClaim(Claims.Name, await _userManager.GetUserNameAsync(user))
+                    .SetClaim(Claims.PreferredUsername, await _userManager.GetUserNameAsync(user))
                     .SetClaims(Claims.Role, (await _userManager.GetRolesAsync(user)).ToImmutableArray());
 
             identity.SetDestinations(GetDestinations);
@@ -352,7 +355,7 @@ private static IEnumerable<string> GetDestinations(Claim claim)
 
         switch (claim.Type)
         {
-            case Claims.Name:
+            case Claims.Name or Claims.PreferredUsername:
                 yield return Destinations.AccessToken;
 
                 if (claim.Subject.HasScope(Scopes.Profile))

diff --git a/samples/Dantooine/Dantooine.WebAssembly.Server/Controllers/AuthenticationController.cs b/samples/Dantooine/Dantooine.WebAssembly.Server/Controllers/AuthenticationController.cs
@@ -106,7 +106,10 @@ public async Task<ActionResult> LogInCallback()
         }
 
         // Build an identity based on the external claims and that will be used to create the authentication cookie.
-        var identity = new ClaimsIdentity(authenticationType: "ExternalLogin");
+        var identity = new ClaimsIdentity(
+            authenticationType: "ExternalLogin",
+            nameType: ClaimTypes.Name,
+            roleType: ClaimTypes.Role);
 
         // By default, OpenIddict will automatically try to map the email/name and name identifier claims from
         // their standard OpenID Connect or provider-specific equivalent, if available. If needed, additional

diff --git a/samples/Fornax/Fornax.Server/Connect/Authorize.aspx.cs b/samples/Fornax/Fornax.Server/Connect/Authorize.aspx.cs
@@ -90,6 +90,7 @@ protected void Page_Load(object sender, EventArgs e) => RegisterAsyncTask(new Pa
                     identity.SetClaim(Claims.Subject, user.Id)
                             .SetClaim(Claims.Email, user.Email)
                             .SetClaim(Claims.Name, user.UserName)
+                            .SetClaim(Claims.PreferredUsername, user.UserName)
                             .SetClaims(Claims.Role, (await context.Get<ApplicationUserManager>().GetRolesAsync(user.Id)).ToImmutableArray());
 
                     // Note: in this sample, the granted scopes match the requested scope
@@ -214,6 +215,7 @@ protected void Accept(object sender, EventArgs e) => RegisterAsyncTask(new PageA
             identity.SetClaim(Claims.Subject, user.Id)
                     .SetClaim(Claims.Email, user.Email)
                     .SetClaim(Claims.Name, user.UserName)
+                    .SetClaim(Claims.PreferredUsername, user.UserName)
                     .SetClaims(Claims.Role, (await context.Get<ApplicationUserManager>().GetRolesAsync(user.Id)).ToImmutableArray());
 
             // Note: in this sample, the granted scopes match the requested scope
@@ -266,7 +268,7 @@ private static IEnumerable<string> GetDestinations(Claim claim)
 
             switch (claim.Type)
             {
-                case Claims.Name:
+                case Claims.Name or Claims.PreferredUsername:
                     yield return Destinations.AccessToken;
 
                     if (claim.Subject.HasScope(Scopes.Profile))

diff --git a/samples/Hollastin/Hollastin.Server/Controllers/AuthorizationController.cs b/samples/Hollastin/Hollastin.Server/Controllers/AuthorizationController.cs
@@ -78,6 +78,7 @@ public async Task<IActionResult> Exchange()
             identity.SetClaim(Claims.Subject, await _userManager.GetUserIdAsync(user))
                     .SetClaim(Claims.Email, await _userManager.GetEmailAsync(user))
                     .SetClaim(Claims.Name, await _userManager.GetUserNameAsync(user))
+                    .SetClaim(Claims.PreferredUsername, await _userManager.GetUserNameAsync(user))
                     .SetClaims(Claims.Role, (await _userManager.GetRolesAsync(user)).ToImmutableArray());
 
             // Set the list of scopes granted to the client application.
@@ -105,7 +106,7 @@ private static IEnumerable<string> GetDestinations(Claim claim)
 
         switch (claim.Type)
         {
-            case Claims.Name:
+            case Claims.Name or Claims.PreferredUsername:
                 yield return Destinations.AccessToken;
 
                 if (claim.Subject.HasScope(Scopes.Profile))

diff --git a/samples/Imynusoph/Imynusoph.Server/Controllers/AuthorizationController.cs b/samples/Imynusoph/Imynusoph.Server/Controllers/AuthorizationController.cs
@@ -77,6 +77,7 @@ public async Task<IActionResult> Exchange()
             identity.SetClaim(Claims.Subject, await _userManager.GetUserIdAsync(user))
                     .SetClaim(Claims.Email, await _userManager.GetEmailAsync(user))
                     .SetClaim(Claims.Name, await _userManager.GetUserNameAsync(user))
+                    .SetClaim(Claims.PreferredUsername, await _userManager.GetUserNameAsync(user))
                     .SetClaims(Claims.Role, (await _userManager.GetRolesAsync(user)).ToImmutableArray());
 
             // Note: in this sample, the granted scopes match the requested scope
@@ -128,6 +129,7 @@ public async Task<IActionResult> Exchange()
             identity.SetClaim(Claims.Subject, await _userManager.GetUserIdAsync(user))
                     .SetClaim(Claims.Email, await _userManager.GetEmailAsync(user))
                     .SetClaim(Claims.Name, await _userManager.GetUserNameAsync(user))
+                    .SetClaim(Claims.PreferredUsername, await _userManager.GetUserNameAsync(user))
                     .SetClaims(Claims.Role, (await _userManager.GetRolesAsync(user)).ToImmutableArray());
 
             identity.SetDestinations(GetDestinations);
@@ -146,7 +148,7 @@ private static IEnumerable<string> GetDestinations(Claim claim)
 
         switch (claim.Type)
         {
-            case Claims.Name:
+            case Claims.Name or Claims.PreferredUsername:
                 yield return Destinations.AccessToken;
 
                 if (claim.Subject.HasScope(Scopes.Profile))

diff --git a/samples/Kalarba/Kalarba.Server/Startup.cs b/samples/Kalarba/Kalarba.Server/Startup.cs
@@ -88,6 +88,7 @@ public void Configuration(IAppBuilder app)
                         // Add the claims that will be persisted in the tokens.
                         identity.AddClaim(new Claim(Claims.Subject, "999d4ea0-164f-4c1b-8585-b83f313995c9"));
                         identity.AddClaim(new Claim(Claims.Name, "Alice").SetDestinations(Destinations.AccessToken));
+                        identity.AddClaim(new Claim(Claims.PreferredUsername, "Alice").SetDestinations(Destinations.AccessToken));
 
                         context.SignIn(new ClaimsPrincipal(identity));
 

diff --git a/samples/Matty/Matty.Server/Controllers/AuthorizationController.cs b/samples/Matty/Matty.Server/Controllers/AuthorizationController.cs
@@ -105,6 +105,7 @@ public async Task<IActionResult> VerifyAccept()
             identity.SetClaim(Claims.Subject, await _userManager.GetUserIdAsync(user))
                     .SetClaim(Claims.Email, await _userManager.GetEmailAsync(user))
                     .SetClaim(Claims.Name, await _userManager.GetUserNameAsync(user))
+                    .SetClaim(Claims.PreferredUsername, await _userManager.GetUserNameAsync(user))
                     .SetClaims(Claims.Role, (await _userManager.GetRolesAsync(user)).ToImmutableArray());
 
             // Note: in this sample, the granted scopes match the requested scope
@@ -190,6 +191,7 @@ public async Task<IActionResult> Exchange()
             identity.SetClaim(Claims.Subject, await _userManager.GetUserIdAsync(user))
                     .SetClaim(Claims.Email, await _userManager.GetEmailAsync(user))
                     .SetClaim(Claims.Name, await _userManager.GetUserNameAsync(user))
+                    .SetClaim(Claims.PreferredUsername, await _userManager.GetUserNameAsync(user))
                     .SetClaims(Claims.Role, (await _userManager.GetRolesAsync(user)).ToImmutableArray());
 
             identity.SetDestinations(GetDestinations);
@@ -209,7 +211,7 @@ private static IEnumerable<string> GetDestinations(Claim claim)
 
         switch (claim.Type)
         {
-            case Claims.Name:
+            case Claims.Name or Claims.PreferredUsername:
                 yield return Destinations.AccessToken;
 
                 if (claim.Subject.HasScope(Scopes.Profile))

diff --git a/samples/Mimban/Mimban.Server/Program.cs b/samples/Mimban/Mimban.Server/Program.cs
@@ -161,7 +161,11 @@ await manager.CreateAsync(new OpenIddictApplicationDescriptor
     // Resolve the claims extracted by OpenIddict from the userinfo response returned by GitHub.
     var result = await context.AuthenticateAsync(OpenIddictClientAspNetCoreDefaults.AuthenticationScheme);
 
-    var identity = new ClaimsIdentity(authenticationType: "ExternalLogin");
+    var identity = new ClaimsIdentity(
+        authenticationType: "ExternalLogin",
+        nameType: ClaimTypes.Name,
+        roleType: ClaimTypes.Role);
+
     identity.AddClaim(new Claim(ClaimTypes.NameIdentifier, result.Principal!.FindFirst("id")!.Value));
 
     var properties = new AuthenticationProperties
@@ -203,6 +207,7 @@ await manager.CreateAsync(new OpenIddictApplicationDescriptor
     // Import a few select claims from the identity stored in the local cookie.
     identity.AddClaim(new Claim(Claims.Subject, identifier));
     identity.AddClaim(new Claim(Claims.Name, identifier).SetDestinations(Destinations.AccessToken));
+    identity.AddClaim(new Claim(Claims.PreferredUsername, identifier).SetDestinations(Destinations.AccessToken));
 
     return Results.SignIn(new ClaimsPrincipal(identity), properties: null, OpenIddictServerAspNetCoreDefaults.AuthenticationScheme);
 });

diff --git a/samples/Mortis/Mortis.Server/Controllers/AuthorizationController.cs b/samples/Mortis/Mortis.Server/Controllers/AuthorizationController.cs
@@ -107,6 +107,7 @@ public async Task<ActionResult> Authorize()
                     identity.SetClaim(Claims.Subject, user.Id)
                             .SetClaim(Claims.Email, user.Email)
                             .SetClaim(Claims.Name, user.UserName)
+                            .SetClaim(Claims.PreferredUsername, user.UserName)
                             .SetClaims(Claims.Role, (await context.Get<ApplicationUserManager>().GetRolesAsync(user.Id)).ToImmutableArray());
 
                     // Note: in this sample, the granted scopes match the requested scope
@@ -225,6 +226,7 @@ public async Task<ActionResult> Accept()
             identity.SetClaim(Claims.Subject, user.Id)
                     .SetClaim(Claims.Email, user.Email)
                     .SetClaim(Claims.Name, user.UserName)
+                    .SetClaim(Claims.PreferredUsername, user.UserName)
                     .SetClaims(Claims.Role, (await context.Get<ApplicationUserManager>().GetRolesAsync(user.Id)).ToImmutableArray());
 
             // Note: in this sample, the granted scopes match the requested scope
@@ -344,6 +346,7 @@ public async Task<ActionResult> Exchange()
                 identity.SetClaim(Claims.Subject, user.Id)
                         .SetClaim(Claims.Email, user.Email)
                         .SetClaim(Claims.Name, user.UserName)
+                        .SetClaim(Claims.PreferredUsername, user.UserName)
                         .SetClaims(Claims.Role, (await context.Get<ApplicationUserManager>().GetRolesAsync(user.Id)).ToImmutableArray());
 
                 identity.SetDestinations(GetDestinations);
@@ -365,7 +368,7 @@ private static IEnumerable<string> GetDestinations(Claim claim)
 
             switch (claim.Type)
             {
-                case Claims.Name:
+                case Claims.Name or Claims.PreferredUsername:
                     yield return Destinations.AccessToken;
 
                     if (claim.Subject.HasScope(Scopes.Profile))

diff --git a/samples/Velusia/Velusia.Client/Controllers/AuthenticationController.cs b/samples/Velusia/Velusia.Client/Controllers/AuthenticationController.cs
@@ -106,7 +106,10 @@ public async Task<ActionResult> LogInCallback()
         }
 
         // Build an identity based on the external claims and that will be used to create the authentication cookie.
-        var identity = new ClaimsIdentity(authenticationType: "ExternalLogin");
+        var identity = new ClaimsIdentity(
+            authenticationType: "ExternalLogin",
+            nameType: ClaimTypes.Name,
+            roleType: ClaimTypes.Role);
 
         // By default, OpenIddict will automatically try to map the email/name and name identifier claims from
         // their standard OpenID Connect or provider-specific equivalent, if available. If needed, additional

diff --git a/samples/Velusia/Velusia.Server/Controllers/AuthenticationController.cs b/samples/Velusia/Velusia.Server/Controllers/AuthenticationController.cs
@@ -54,7 +54,10 @@ public async Task<ActionResult> LogInCallback()
         }
 
         // Build an identity based on the external claims and that will be used to create the authentication cookie.
-        var identity = new ClaimsIdentity(authenticationType: "ExternalLogin");
+        var identity = new ClaimsIdentity(
+            authenticationType: "ExternalLogin",
+            nameType: ClaimTypes.Name,
+            roleType: ClaimTypes.Role);
 
         // By default, OpenIddict will automatically try to map the email/name and name identifier claims from
         // their standard OpenID Connect or provider-specific equivalent, if available. If needed, additional

diff --git a/samples/Velusia/Velusia.Server/Controllers/AuthorizationController.cs b/samples/Velusia/Velusia.Server/Controllers/AuthorizationController.cs
@@ -141,6 +141,7 @@ public async Task<IActionResult> Authorize()
                 identity.SetClaim(Claims.Subject, await _userManager.GetUserIdAsync(user))
                         .SetClaim(Claims.Email, await _userManager.GetEmailAsync(user))
                         .SetClaim(Claims.Name, await _userManager.GetUserNameAsync(user))
+                        .SetClaim(Claims.PreferredUsername, await _userManager.GetUserNameAsync(user))
                         .SetClaims(Claims.Role, (await _userManager.GetRolesAsync(user)).ToImmutableArray());
 
                 // Note: in this sample, the granted scopes match the requested scope
@@ -234,6 +235,7 @@ public async Task<IActionResult> Accept()
         identity.SetClaim(Claims.Subject, await _userManager.GetUserIdAsync(user))
                 .SetClaim(Claims.Email, await _userManager.GetEmailAsync(user))
                 .SetClaim(Claims.Name, await _userManager.GetUserNameAsync(user))
+                .SetClaim(Claims.PreferredUsername, await _userManager.GetUserNameAsync(user))
                 .SetClaims(Claims.Role, (await _userManager.GetRolesAsync(user)).ToImmutableArray());
 
         // Note: in this sample, the granted scopes match the requested scope
@@ -333,6 +335,7 @@ public async Task<IActionResult> Exchange()
             identity.SetClaim(Claims.Subject, await _userManager.GetUserIdAsync(user))
                     .SetClaim(Claims.Email, await _userManager.GetEmailAsync(user))
                     .SetClaim(Claims.Name, await _userManager.GetUserNameAsync(user))
+                    .SetClaim(Claims.PreferredUsername, await _userManager.GetUserNameAsync(user))
                     .SetClaims(Claims.Role, (await _userManager.GetRolesAsync(user)).ToImmutableArray());
 
             identity.SetDestinations(GetDestinations);
@@ -352,7 +355,7 @@ private static IEnumerable<string> GetDestinations(Claim claim)
 
         switch (claim.Type)
         {
-            case Claims.Name:
+            case Claims.Name or Claims.PreferredUsername:
                 yield return Destinations.AccessToken;
 
                 if (claim.Subject.HasScope(Scopes.Profile))

diff --git a/samples/Zirku/Zirku.Server/Program.cs b/samples/Zirku/Zirku.Server/Program.cs
@@ -263,6 +263,12 @@ await manager.CreateAsync(new OpenIddictScopeDescriptor
         2 => "Bob",
         _ => throw new InvalidOperationException()
     }));
+    identity.AddClaim(new Claim(Claims.PreferredUsername, identifier switch
+    {
+        1 => "Alice",
+        2 => "Bob",
+        _ => throw new InvalidOperationException()
+    }));
 
     // Note: in this sample, the client is granted all the requested scopes for the first identity (Alice)
     // but for the second one (Bob), only the "api1" scope can be granted, which will cause requests sent