Is fine to configure IdentityOption to use Subject as UserId?

[kamnab]

I have integrated OpenIddict with AuthP and this led to use Subject as claim based for the authentication. However, some parts got errors that require to modify the claim type of NameIdentifier to Subject. I am not sure if this needs to be checked in somewhere else, pls advise

[JonPSmith]

Hi @kamnab,

I'm pleased to hear that you are integrated OpenIddict with AuthP, as that could be useful for others. But I will need some more information to help you with the errors you have. Please show your code and include the exception's stracktrace.

In the meantime here are some comments / links that might help you in the design of your OpenIddict server.

To use the AuthP library you need to:

1. Link the ASP.NET Core authenticated user to the AuthP user. This is done by taking the ClaimTypes.NameIdentifier claim (which I refer to as the userId) of the ASP.NET Core authenticated user and using this userId when creating the AuthP.
2. You need a way to add the extra AuthP claims to the user's claims. Typically we intercept the login and add the AuthP claims (see the in the AuthPRegion in the AzureAdOpenIdExtension code).

Looking at OpenIddict

The problem is to link a new OpenIddict user to a AuthP user, with the AuthP Roles, Tenant etc.

I can see three possible approaches, but I don't understand OpenIddict well enough to say which will work.

1. The first is complex, but I'm sure it would work. In this case you would add the AuthP library to your OpenIddict server so that you can create an AuthP whenever a new user is added. As I said its complex so contact me if you want to go this way.
2. If you can add a feature in your OpenIddict server to allow your main application find a OpenIddict user by email and create a new OpenIddict user, then you can use the way the new AzureAdNewUserManager works - see the article Three ways to securely add new users to an application using the AuthP library for more.
3. If you can add a feature in your OpenIddict server to allow main application to return all the OpenIddict users you could use the "sync users" approach. Again see the article Three ways to securely add new users to an application using the AuthP library for more.

[kamnab]

Thank you for your suggestion.

Let me provide you configuration I have made and error I got:

This got error if I do not check claim type with x.Type == "sub"

[JonPSmith]

I now see what your problem is - the claims names don't match the normal ASP.NET Core claim names. I had this problem when working with Azure AD and I had to alter claims in the event handler - see this section of the of the OpenIdConnect login event.

So in your situation you just have to create a claim with the type of ClaimTypes.NameIdentifier for AuthP to work, and you can do that within the login event.