[OpenID Connect] ClaimsPrincipal doesn't contain scope claim

[hieucd04]

I have this piece of code and my question is in the comments:

// This is inside a MVC Controller

// This line of code returns a valid JWT access token.
// I hope this also indicates that I have setup the OpenID Connect in Orchard Core correctly.
var accessToken = await HttpContext.GetTokenAsync(OpenIdConnectDefaults.AuthenticationScheme, "access_token");

// This line of code returns "false".
// Previously, I used Identity Server 4 and it returned "true".
// How do I make it return "true" in Orchard Core?
var hasScopeClaim = User.Claims.Any(x => x.Type == "scope");

My setup code inside an Orchard Core Module:

services.AddAuthentication(options =>
{
    options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
    options.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme;
})
.AddCookie(CookieAuthenticationDefaults.AuthenticationScheme)
.AddOpenIdConnect(OpenIdConnectDefaults.AuthenticationScheme, options =>
{
    options.SaveTokens = true;
    options.RequireHttpsMetadata = false; // TODO: Development only

    options.Authority = "http://localhost:5002";
    options.ClientId = "oidc-interactive";
    options.ClientSecret = "CHANGE-THIS";

    options.ResponseType = OpenIdConnectResponseType.Code;
});

This is an example decoded payload data from the access_token above. You can see that it has the scope claim and I want that scope claim to be present in the User.Claims code above.

{
  "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "4qj0synsd5ygvsbjvnzm7xr8mw",
  "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "admin",
  "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress": "[email protected]",
  "http://schemas.microsoft.com/ws/2008/06/identity/claims/role": "Administrator",
  "Permission": [
    "ManageSettings",
    "PublishContent",
    "EditContent",
    "DeleteContent",
    "PreviewContent",
    "CloneContent",
    "AccessContentApi",
    "ListContent",
    "ViewContentTypes",
    "EditContentTypes",
    "ManageShortcodeTemplates",
    "AccessAdminPanel",
    "ManageAdminSettings",
    "ManageTemplates",
    "ManageAdminTemplates",
    "SetHomepage",
    "ManageUsers",
    "Import",
    "Export",
    "ManageRemoteInstances",
    "ManageRemoteClients",
    "ExportRemoteInstances",
    "ManageLayers",
    "ManageIndexes",
    "ManageMediaFolder",
    "ManageMediaProfiles",
    "ViewMediaOptions",
    "ManageMenu",
    "ManageApplications",
    "ManageScopes",
    "ManageClientSettings",
    "ManageServerSettings",
    "ManageValidationSettings",
    "ManageQueries",
    "ManageRoles",
    "SiteOwner",
    "ManageTenants",
    "ManageTenantFeatureProfiles",
    "ApplyTheme"
  ],
  "email": "[email protected]",
  "email_verified": true,
  "oc:entyp": "user",
  "sub": "4qj0synsd5ygvsbjvnzm7xr8mw",
  "name": "admin",
  "oi_prst": "oidc-interactive",
  "oi_au_id": "4d7a06f96b364ae19bbb8299e9dc4d08",
  "client_id": "oidc-interactive",
  "oi_tkn_id": "2ff2210d626448829624a0f7ae84c0fd",
  "aud": "oct:Default",
  "scope": "openid profile read:protected-pages",
  "exp": 1662468055,
  "iss": "http://localhost:5002/",
  "iat": 1662464455
}

Let me know if you need any more info.
I will try to share what I can.

[ns8482e]

I guess scope is not one of pre-defined type https://docs.microsoft.com/en-us/dotnet/api/system.security.claims.claimtypes?view=net-6.0#fields

Try User.FindFirst("scope")?.Value

[hieucd04]

I guess scope is not one of pre-defined type https://docs.microsoft.com/en-us/dotnet/api/system.security.claims.claimtypes?view=net-6.0#fields

No, it is not!

User.FindFirst("scope")?.Value

Sadly, it doesn't work.
.FindFirst(...) just looks in User (User is of type ClaimsPrincipal) which doesn't contain the scope claim.

[ns8482e]

May be you need custom ClaimsTransformer

[hieucd04]

May be you need custom ClaimsTransformer

That is the part where I'm not 100% sure.
I did take a look: https://docs.microsoft.com/en-us/aspnet/core/security/authentication/claims?view=aspnetcore-6.0
... and ended up writing a .NET Middleware that extracts the access_token and transfers its claims to ClaimsPrincipal. Different implementation but the same idea though.

I'm so confused that the so called ClaimsPrincipal doesn't have the claims I need.