A claim is a named assertion about a subject or token context, represented as a property in a security token. In a JWT, claims occupy the payload alongside identity, audience, issuer, and validity metadata. section 9.6
Common claims describe:
- aud, the intended client or audience. section 9.6
- iss, nbf, iat, and exp, which identify the issuer and constrain token validity. section 9.6
- sub, often identifying the represented user, and preferred_username, a custom Azure AD username claim. section 9.6
Reading a claim for authorization
An authorization handler can retrieve preferred_username from context.User with FindFirst, compare its value with the permitted email address, and succeed only when they match. section 9.6
Listing 9.22 Custom authorization requirement and handler
using Microsoft.AspNetCore.Authorization;
namespace ManningBooksApi;
public class OnlyMeRequirement : #1
IAuthorizationRequirement { } #2
public class OnlyMeRequirementHandler :
AuthorizationHandler<OnlyMeRequirement> #3
{
protected override Task HandleRequirementAsync( #4
AuthorizationHandlerContext context, #5
OnlyMeRequirement requirement)
{
if (context.User != null) #6
{
var emailClaim = context.User
.FindFirst("preferred_username"); #7
if (emailClaim != null
&& emailClaim.Value == "your@email.com") #8
{
context.Succeed(requirement); #9
}
}
return Task.CompletedTask; #10
}
}
Inspect the focused handler implementation that retrieves a claim and uses its value to satisfy an authorization requirement. section 9.6
