authenticationidentityserver4asp.net-apicontroller

how to find OAuth flow type from controller after authentication?


I use IdentityServer4 to protect my .Net Core based API. In my API controllers, I need to determine what type of authentication flow (client credential, authorization code, etc.) the client is using. But I can't find it from ClaimsPrincipal or anywhere else. How can I find the flow from API controller?


Solution

  • For WEB.API's in ASP.NET Core you alawys use the AddJwtBearer method in your startup class to protect it. It will look at the incoming request and then if a valid token is found, create a ClaimsPrincipal user.

    Then if you are not seeing any claims in the ClaimsPrincipal, then that can depend on many other factors, what does your access token contain? and what ClaimsMapping have you done.

    Like this picture show: enter image description here

    To tell the clients apart in the API, you can use ClientClaims in IdentityServer .

    Like this picture from one of my training classes shows:

    enter image description here