How do I access the user roles in the client

[Kyemate]

I updated the AppUserClaimsPrincipalFactory to include the roles and while debugging the roles are included into the ClaimsIdentity.
But when i try to access the roles with the AuthenticationManager it doesn't return any roles

Edit I tried to access the roles in the identitycontroller sign in with this code and also here it didn't return any roles

var principal = await signInManager.CreateUserPrincipalAsync(user);
var roles = principal.Claims.Where(c => c.Type == ClaimTypes.Role).Select(c => c.Value);

[ysmoradi]

As far as I know, database's user roles and user claims tables values are automatically stored in jwt token
AppUserClaimsPrincipalFactory is there for other values that are not present in those two tables, for example user session Id.

https://github.com/bitfoundation/bitplatform/blob/develop/src/Templates/Boilerplate/Bit.Boilerplate/src/Shared/Extensions/ISharedServiceCollectionExtensions.cs#L31

[Kyemate]

As far as I know, database's user roles and user claims tables values are automatically stored in jwt token AppUserClaimsPrincipalFactory is there for other values that are not present in those two tables, for example user session Id.

https://github.com/bitfoundation/bitplatform/blob/develop/src/Templates/Boilerplate/Bit.Boilerplate/src/Shared/Extensions/ISharedServiceCollectionExtensions.cs#L31

I just tried to add a role to the [email protected] user in the default template with no changes and the role doesn't seem to be included in the claims

Edit:
After some more digging, when adding this code to the AppUserClaimsPrincipalFactory

var roles = await UserManager.GetRolesAsync(user);
foreach (var role in roles)
{
    identity.AddClaim(new Claim(ClaimTypes.Role, role));
}

The roles seems to be sent out to the client in the access_token and refresh_token but it's still not able to retrieve them with the authenticationMananger

Edit 2:
The authenticationManager seems to be able to retrieve all the claims but they come out in the wrong order, so this code for example wont find the claims even thou they there

var authState = await AuthenticationStateProvider.GetAuthenticationStateAsync().ConfigureAwait(true);
user = authState.User;
List<Claim> roleClaims = user.FindAll(ClaimTypes.Role).ToList();

[Kyemate]

The final solution was to replace the ParseTokenClaims code in AuthenticationManager with this:

var handler = new JwtSecurityTokenHandler();

if (handler.CanReadToken(jwtToken))
{
    var token = handler.ReadJwtToken(jwtToken);

    var claims = token.Claims;

    var identity = new ClaimsIdentity(claims, "jwt");
    return new ClaimsPrincipal(identity);
}
throw new ArgumentException("Invalid JWT token.");

updating AppUserClaimsPrincipalFactory to this

var identity = await base.GenerateClaimsAsync(user);
identity.AddClaims(SessionClaims);

var roles = await UserManager.GetRolesAsync(user);
foreach (var role in roles)
{
    identity.AddClaim(new Claim(ClaimTypes.Role, role));
}

return identity;

and this is the code I use to retrieve the roles in the client.

var authState = await authenticationManager.GetAuthenticationStateAsync();
user = authState.User;
List<Claim> roleClaims = user.FindAll("role").ToList();

[Kyemate]

This seems to be a better solution. Seems to be a microsoft problem...

https://nestenius.se/net/debugging-jwtbearer-claim-problems-in-asp-net-core/

https://stackoverflow.com/questions/77548311/role-claim-not-working-in-asp-net-core-8-web-api-after-upgrading-to-net-8

[ysmoradi]

I just had a chance to test it right now and I see roles are not included, but they were supposed to be there without changing anything
Let me check

[ysmoradi]

#9131
Now solved @Kyemate

[Kyemate]

#9131 Now solved @Kyemate

Thanks, for the fix. There is still the microsoft bugg that all their claim constants point to for example "http://schemas.microsoft.com/ws/2008/06/identity/claims/role"

and in the jwt token the claim is named 'role'. So all built in methods that uses the claim constants like ClaimsPrincipal.IsInRole for example will not work.

[ysmoradi]

Is that also happens in our project?

[msynk]

@Kyemate The PR just merged, and we didn't publish any release/prerelease for it.
But the fix is simple: Just apply the changes of PR #9131 to your AppUserClaimsPrincipalFactory class.

[ysmoradi]

It seems that he's still issue, I'm thing to investigate today

[Kyemate]

It seems that he's still issue, I'm thing to investigate today

I think I finally found the problem. I tested it on the new 12.11 template today.

the authentication works if I only have one role but if I have multiple roles, the roles get decoded from the jwt as a single string. like this
"["Test1","Test2","Test3"]" instead of an array

Edit

Seems like it's this method that needs to have an check if the claim is an array then deconstruct it to multiple claims

private IEnumerable<Claim> ParseTokenClaims(string access_token)
{
    return ParseJwt(access_token)
        .Select(keyValue => new Claim(keyValue.Key, keyValue.Value.ToString() ?? string.Empty))
        .ToArray();
}

[Kyemate]

Now it works on both the client and server side for me. This was the fix I did in the authentication manager

private IEnumerable<Claim> ParseTokenClaims(string access_token)
{
    var parsedClaims = ParseJwt(access_token);

    var claims = new List<Claim>();
    foreach (var keyValue in parsedClaims)
    {
        if (keyValue.Value is JsonElement jsonElement && jsonElement.ValueKind == JsonValueKind.Array)
        {
            foreach (var element in jsonElement.EnumerateArray())
            {
                claims.Add(new Claim(keyValue.Key, element.ToString() ?? string.Empty));
            }
        }
        else
        {
            claims.Add(new Claim(keyValue.Key, keyValue.Value.ToString() ?? string.Empty));
        }
    }

    return claims;
}

[ysmoradi]

Sorry, the code you provided is required! We were using a library to handle jwt parse method before, but in order to reduce the app size, we removed that library.
I'm going to submit a PR for this @Kyemate

[ysmoradi]

#9147 @Kyemate