Enrich Token Claims with ASP.NET Core

March 23, 2022 1 min read BEN ABT

Often you have the requirement that you need or want to add additional claims to a token - either the, ID token or the access token. This is especially useful when one needs an additional custom enrichment that is not available at the time of token creation.

ASP.NET Core has a corresponding interface in the Auth pipeline for this purpose: the IClaimsTransformation .

All implementations of this interface are instantiated automatically if they have been registered.

C#
services.AddScoped<IClaimsTransformation, AddCustomClaimsToIdentityTransformation>();

All implementations are run through in the order in which they were registered.

The implementation itself is very simple:

C#
 1public class AddCustomClaimsToIdentityTransformation : IClaimsTransformation
 2{
 3    public async Task<ClaimsPrincipal> TransformAsync(ClaimsPrincipal principal)
 4    {
 5        ClaimsPrincipal clone = principal.Clone();
 6        ClaimsIdentity newIdentity = (ClaimsIdentity)clone.Identity;
 7
 8        // support aad / ad / others, too
 9        Claim? nameId = principal.Claims
10            .FirstOrDefault(c => c.Type == ClaimTypes.NameIdentifier || c.Type == ClaimTypes.Name);
11        if (nameId is null) return principal;
12
13        // request data from your claim source
14        var myClaimData = await _myRepository.GetAdditionClaimsOfUser(nameId).ConfigureAwait(false);
15        foreach (var customClaim in myClaimData)
16        {  
17            newIdentity.AddClaim(new(customClaim.Type, customClaim.Value));
18        }
19
20        return clone;
21    }
22}