使用 Owin 从 JWT 获取自定义声明

Question

我将 Owin 与 JWTBearerAuthentication 结合使用来授权用户并验证他们的令牌。我是这样做的：

public class Startup
{
    public void Configuration(IAppBuilder app)
    {
        HttpConfiguration config = new HttpConfiguration();
        config.MapHttpAttributeRoutes();

        config.Routes.MapHttpRoute(
            name: "DefaultApi",
            routeTemplate: "api/{controller}/{id}",
            defaults: new { id = RouteParameter.Optional }
        );

        ConfigureOAuth(app);
        app.UseWebApi(config);
    }

    private void ConfigureOAuth(IAppBuilder app)
    {
        string issuer = ConfigurationManager.AppSettings.Get("auth_issuer");
        string audience = ConfigurationManager.AppSettings.Get("auth_clientId");
        byte[] secret = TextEncodings.Base64Url.Decode(ConfigurationManager.AppSettings.Get("auth_secret"));

        app.UseJwtBearerAuthentication(new JwtBearerAuthenticationOptions 
        {
            AuthenticationMode = AuthenticationMode.Active,
            AllowedAudiences = new [] { audience },
            IssuerSecurityTokenProviders = new IIssuerSecurityTokenProvider[]
            {
                new SymmetricKeyIssuerSecurityTokenProvider(issuer, secret)
            }
        });
    }
}

但是，我的令牌中有一些自定义声明，我想在我的 ApiController 中使用它们的值，如下所示：

[RoutePrefix("endpoint")]
public class MyApiController : ApiController
{
    [Route("action")]
    [Authorize]
    public IHttpActionResult Post(string someValue)
    {
        bool res = DoSomeAction.withTheString(someValue);

        if (res)
        {
            return Ok<string>(someValue);
        }

        return InternalServerError();
    }
}

是否有类似 User.Claims["myCustomClaim"].Value 的东西，它提供了所有索赔的价值？

谢谢，卢卡斯

Answer 1

这样的事情可能会有所帮助：

var identity = User.Identity as ClaimsIdentity;

        return identity.Claims.Select(c => new
        {
            Type = c.Type,
            Value = c.Value
        });

使用 Owin 从 JWT 获取自定义声明

Get custom claims from a JWT using Owin

c#

jwt

asp.net-web-api

owin

asp.net-identity