ConfigureJwtBearer hardcodes MapInboundClaims to false, NameIdentifier is Null IdentityServer, Sub not mapped to NameIdentifier about identityserver4.accesstokenvalidation HOT 5 CLOSED

Adding to this ticket is a workaround:

Create this class:

  public class ConfigureJwtBearerOptions : IPostConfigureOptions<JwtBearerOptions>
   {
       public void PostConfigure(string name, JwtBearerOptions options)
       {
           options.SecurityTokenValidators.Clear();
           options.SecurityTokenValidators.Add(new JwtSecurityTokenHandler()
           {
               MapInboundClaims = true
           });
       }
   }

Add this to the services collection:
services.AddSingleton<IPostConfigureOptions<JwtBearerOptions>, ConfigureJwtBearerOptions>();

from identityserver4.accesstokenvalidation.

Why do you want to map claims to Microsoft proprietary values? Doesn't make sense.

from identityserver4.accesstokenvalidation.

Some libraries by default rely on NameIdentifier (http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier)
eg
https://docs.microsoft.com/en-us/aspnet/core/signalr/groups?view=aspnetcore-3.1

Not saying that their proprietary values make sense, and there is a work around so perhaps that should be part of the documentation?

from identityserver4.accesstokenvalidation.

Yes - it should be part of Microsoft's documentation.

from identityserver4.accesstokenvalidation.

Ok.

Well I hope other people who run into this issue can see this ticket and help them with any issues this may cause from them.

Updated Title to reflect the issue.

from identityserver4.accesstokenvalidation.