Allow custom NameClaimType and RoleClaimType in LocalApiAuthenticationHandler.HandleAuthenticateAsync

[bilenth]

Currently, in the method LocalApiAuthenticationHandler.HandleAuthenticateAsync, the ClaimsIdentityis instantiated with hardcoded claim types:

https://github.com/DuendeSoftware/products/blame/cc5e631a3497bb3b4cc4efc7221de83c59cd0b50/identity-server/src/IdentityServer/Hosting/LocalApiAuthentication/LocalApiAuthenticationHandler.cs#L167

var claimsIdentity = new ClaimsIdentity(tokenResult.Claims, Scheme.Name, JwtClaimTypes.Name, JwtClaimTypes.Role);

Request:

Could we make the NameClaimTypeand RoleClaimTypeconfigurable instead of being hardcoded to JwtClaimTypes.Nameand JwtClaimTypes.Role? This would allow developers to use custom claim types that better match their application's authentication schema.

Proposed Solution:

Add properties (e.g., NameClaimTypeand RoleClaimType) to the authentication options or handler configuration. These properties could then be used when creating the ClaimsIdentity. For example:

var claimsIdentity = new ClaimsIdentity(
    tokenResult.Claims,
    Scheme.Name,
    options.NameClaimType ?? JwtClaimTypes.Name,   // Configurable, with fallback
    options.RoleClaimType ?? JwtClaimTypes.Role    // Configurable, with fallback
);

This change would provide greater flexibility for projects using different claim type identifiers.

[ProgrammerAL]

@bilenth this can be configured by handling the ClaimsTransformation event raised by LocalApiAuthenticationHandler.HandleAuthenticateAsync. In the GitHub link you posted, the event is raised at line 185. By handling that event, you can modify the ClaimsPrincipal and add/remove claims.

I’m not sure how you’re setting up the local api, but since you're talking about the low level LocalApiAuthenticationHandler.HandleAuthenticateAsync() method, you might be able to simplify some of your code by using the builder.Services.AddLocalApiAuthentication(); helper. There's some more details at: https://docs.duendesoftware.com/identityserver/apis

builder.Services.AddLocalApiAuthentication(principal =>
{
    principal.Identities.First().AddClaim(new Claim("my-custom-scope", "my_local_api"));
    return Task.FromResult(principal);
});