Update Claims to Principal after Token Validation - owin

Question

I have API which makes use of JWTBearerAuthentication. Everything works fine from Authentication perspective. However there is a need to update the Claims on the principal after the validation is complete. There are some information which I have to derive instead of receiving from source (token) claims. I was thinking if there is a way that after the validation is successful I can add some claims to existing claims identity/ principal to perform some access rights stuff. Below is the sample code in my start up class.
app.UseJwtBearerAuthentication(
new JwtBearerAuthenticationOptions
{
TokenHandler = new ValidateJwtSecurityTokenHandlerforLogs(_loggingService, _environment),
AuthenticationMode = AuthenticationMode.Active,
TokenValidationParameters = new TokenValidationParameters()
{
NameClaimType = JwtClaimTypes.Name,
RoleClaimType = OpenIDConfiguration.Permission,
ValidateAudience = false,
ValidIssuer = authority,
IssuerSigningKeyResolver = (token, securityToken, identifier, parameters) =>
{
var discoveryDocument = Task.Run(() => configurationManager.GetConfigurationAsync()).GetAwaiter().GetResult();
return discoveryDocument.SigningKeys;
}
}
});

Answer 1

You have several options to modify the claims after authentication:
One option is
options.Events = new JwtBearerEvents()
{
OnTokenValidated = context =>
{
// Token has passed validation and a ClaimsIdentity has been generated.
context.Principal.Identities.First().AddClaim(new Claim("VIPCustomer", "YES"));
return Task.CompletedTask;
}
};
To enable more advanced claims transformation scenarios, we can add a custom transformation class
public class BonusLevelClaimTransformation : IClaimsTransformation
{
public Task<ClaimsPrincipal> TransformAsync(ClaimsPrincipal principal)
{
if (!principal.HasClaim(c => c.Type == "bonuslevel"))
{
//Lookup bonus level.....
principal.Identities.First().AddClaim(new Claim("bonuslevel", "12345"));
}
return Task.FromResult(principal);
}
}
Then we register it in Startup.cs:
services.AddTransient<IClaimsTransformation, BonusLevelClaimTransformation>();