DefaultAuthorizationService call to _logger.UserAuthorizationSucceeded always has a null user

[strtdusty]

All of my API call logs say "Authorization was successful for user: null" because Name is always null on user.Identity. It seems the name would always be populated from an identity token which usually wouldn't be passed to an API. It seems the best you could do here would be to log the sub claim? Maybe I'm missing something though.

[blowdart]

@HaoK - probably need a few claims to look for here, not just name

[HaoK]

Yeah we assumed name would be universally available, guess not for API, We could trim the msg when there's no name. Or is there a backup claim we can use instead of name? NameIdentifier?

[blowdart]

Yea, fall back to NameIdentifier, then maybe SID & UPN? Are we checking the NameClaimType? We should honour that first

[HaoK]

We don't do much logic right now, we can replace the simple logic with a helper method that does fallback if name is null

https://github.com/aspnet/Security/blob/dev/src/Microsoft.AspNetCore.Authorization/DefaultAuthorizationService.cs#L54

[blowdart]

Yea, that needs improving :)

[blowdart]

Can you squeeze it into RC2?

[HaoK]

This should go through triage since its only affecting logging messages

[blowdart]

Spoilsport :p I'm still leaving it assigned to you though

[brentschmaltz]

For OIDC, the 'sub' claim is required.
@strtdusty what flow are you using? OIDC MW or OAuth MW.
What provider are you using?

[strtdusty]

OIDC MW using AAD
On Mar 31, 2016 10:09 AM, "BrentSchmaltz" notifications@github.com wrote:

For OIDC, the 'sub' claim is required.
@strtdusty https://github.com/strtdusty what flow are you using? OIDC
MW or OAuth MW.
What provider are you using?

—
You are receiving this because you were mentioned.
Reply to this email directly or view it on GitHub
#755 (comment)

[brentschmaltz]

@strtdusty Identity.Name transitively maps to 'unique_name'. There is a way to control which claim is used to back Identity.Name.

[blowdart]

OK so we need sub too :)

[strtdusty]

I think sub would work fine. Probably the best option if all that is
available is the access token.
On Mar 31, 2016 10:20 AM, "Barry Dorrans" notifications@github.com wrote:

OK so we need sub too :)

—
You are receiving this because you were mentioned.
Reply to this email directly or view it on GitHub
#755 (comment)