Include Role Claims when creating ClaimsPrincipal about identityserver2 HOT 12 CLOSED

They should - all roles that don't start with "IdentityServer" should go in the token.

from identityserver2.

Looks like a bug, it is actually including roles that do start with "identityServer" :)

    public IEnumerable<string> GetRoles(string userName)
    {
        var returnedRoles = new List<string>();

        if (Roles.Enabled)
        {
            var roles = Roles.GetRolesForUser(userName);
            returnedRoles = roles.Where(role => role.StartsWith(Constants.Roles.InternalRolesPrefix)).ToList();    
        }

        return returnedRoles;
    }

from identityserver2.

This is the right code:

protected virtual IEnumerable GetRolesForToken(string userName)
{
var returnedRoles = new List();

if (Roles.Enabled)
{
    var roles = Roles.GetRolesForUser(userName);
    returnedRoles = roles.Where(role => !(role.StartsWith(Constants.Roles.InternalRolesPrefix))).ToList();
}

return returnedRoles;

}

in ProviderClaimsRepository.cs

from identityserver2.

Yes, was going to send a pull request but then you said to not bother until the beta :)

from identityserver2.

So I double checked the code - it is working fine here.

from identityserver2.

Perhaps it hasn't updated on GitHub? The code here is incorrect https://github.com/thinktecture/Thinktecture.IdentityServer.v2/blob/master/src/Libraries/Thinktecture.IdentityServer.Core.Repositories/ProviderUserRepository.cs

from identityserver2.

And you are looking at the wrong code.

This is the right file:
https://github.com/thinktecture/Thinktecture.IdentityServer.v2/blob/master/src/Libraries/Thinktecture.IdentityServer.Core.Repositories/ProviderClaimsRepository.cs

from identityserver2.

Yes that file is correct.

However, the instance of IUserRepository injected into ClaimsTransformer for me is of type ProviderUserRepository when requesting an OAuth2 token, not ProviderClaimsRepository.

from identityserver2.

The OAuth controller calls into sts.TryIssueToken. This ultimately invokes the logic in TokenService.cs - and this uses the claims repository. Put some breakpoints into TokenService.cs

from identityserver2.

You're right, it does call the ProviderClaimsRepository after calling ProviderUserRepository, I just hadn't stepped in that far. Why does it call Roles.GetRolesForUser twice?

from identityserver2.

There are two types of roles - the ones that start with IdentityServer are for internal use (authZ in the UI) - all the others are "for tokens".

from identityserver2.

Okay, thanks for clarifying, and your patience. I'll close the issue.

from identityserver2.