AccessTokenManagement for Blazor server and role claims

[njannink]

Situation

• Blazor Server
• AspNetCore backend using JWT
• external OIDC provider (Azure AD B2C or Entra ID)
• roles are managed by the backend

Question
I extend my principal object with the role claims after validation OpenIdConnectEvents.TokenValidated to add for example an admin role. This works perfectly fine and I see the admin related parts in Blazor Server. But after some time I think the token refresh the role claims are dropped and the role specific parts of Blazor are hidden.

What is the correct way (on which events) when using 'AccessTokenManagement.OpenIdConnect' I should extend my principal with the role claims?

[wcabus]

Could you share a bit more about your situation?

• Are you basing your solution on our Blazor sample or on Microsoft's documentation concerning Blazor authentication?
• Are you performing any custom logic already in the cookie or OIDC authentication events?
• "Roles are managed by the backend", where is that exactly? The API you're calling, your Blazor server application, IdentityServer, or something else entirely?
• Which version of Duende.AccessTokenManagement.OpenIdConnect are you using?

[njannink]

My current solution is more or less the same as the blazor sample. I use version 3.2.

The roles come from my database and currently I extend the user principal with the role claims on store in the UserStore. This works fine for the initial sign-in, but then when I check later in the day, so I think after the token has expired+refreshed these claims are gone.

If I add the roles on the CookieEvents ValidatePrincipal it seems to work fine, but this event is fired a lot so that seems overkill to me. What would be your suggestion / hookup point for extending the principal you get from OIDC with additional claims?

[njannink]

I actually found the issue why the claims where not added on token refresh so that part has been resolved. Anyway what would be your suggestion to extend the principal with additional claims? I now do this on OidcEvents.TokenValidated and JwtEvents.TokenValidated, but maybe there is a better way?

[wcabus]

Problem is, there are multiple ways to extend the claims principal: the various events during cookie or OIDC authentication, claims transformation, ...

It's difficult to give an answer that fits all use cases. We are interested however in your solution if you're willing to share it: others could benefit from your solution if they happen to stumble upon this issue 🙂

[njannink]

I now extend my User principal in the Jwt and OIDC events like this

public override async Task TokenValidated(TokenValidatedContext context)
{
    await base.TokenValidated(context);

    if (context.Principal?.Identity?.IsAuthenticated is true)
    {
        await SetRoleClaims(context.Principal);
    }
}

public async Task SetRoleClaims(ClaimsPrincipal principal)
{
    await using var context = await _dbFactory.CreateDbContextAsync();
    await AddRoleClaims(principal, context, principal.GetObjectId());
}

private static async Task AddRoleClaims(ClaimsPrincipal principal, IDbContext context, string id)
{
    var roles = await context.UserRoles
        .Include(x => x.Role)
        .Where(x => x.UserId == id)
        .Select(x => x.Role.Name)
        .ToListAsync();

    if (roles.Count > 0)
    {
        var claims = roles.Select(x => new Claim(ClaimTypes.Role, x));
        var appIdentity = new ClaimsIdentity(claims);

        principal.AddIdentity(appIdentity);
    }
}