BootstrapContext is null on ClaimsIdentity

Question

I have created a new ASP.NET MVC application with .NET 4.5. I have successfully set up authentication with an STS. The authentication flow is working fine and I am able to get the ClaimsIdentity, containing the desired claims, on Thread.CurrentPrincipal.

Now I need the bootstrap token to secure the calls to my service layer. I have set the saveBootstrapContext to true on the identityConfiguration element.

<system.identityModel>
    <identityConfiguration saveBootstrapContext="true">

However, the BootstrapContext property on the ClaimsIdentity is always null.

var identity = Thread.CurrentPrincipal.Identity as ClaimsIdentity;
var context = identity.BootstrapContext; // context is always null

Am I missing anything here? This was supposed to be straightforward :(

Try it out with `identity = ClaimsPrincipal.Current.Identities.First() as ClaimsIdentity` — nemesv, Dec 29 '12 at 17:09
Same result with ClaimsPrincipal.Current.Identities.First(). It is the same instance of Claimsidentity. — Unmesh Kondolikar, Dec 29 '12 at 17:14
How did you setup the external authentication? Using the WS-Federation auth module? — leastprivilege, Dec 30 '12 at 15:35
Did you get it working? I added the flag, but still the bootstrapcontext is null. — Jaanus, Nov 20 '15 at 12:34

score 8 · Answer 1 · edited Mar 16 '18 at 13:11

8

Solved it by these:

<system.identityModel>
    <identityConfiguration saveBootstrapContext="true" />
</system.identityModel>

Also need to set TokenValidationParameters.SaveSigninToken, which is distinct from JwtBearerOptions.SaveTokens:

app.UseWindowsAzureActiveDirectoryBearerAuthentication(
    new WindowsAzureActiveDirectoryBearerAuthenticationOptions {
        Tenant = ConfigurationManager.AppSettings["ida:Tenant"],
        TokenValidationParameters = new TokenValidationParameters {
            SaveSigninToken = true,               
            ValidAudience = ConfigurationManager.AppSettings["ida:Audience"]
        }
    }
);

edited Mar 16 '18 at 13:11

Justin Dearing

14,270
22
88
161

answered Nov 20 '15 at 12:44

Jaanus

16,161
49
147
202

This is really helpful! it solves my long time puzzle. – Shuping Jul 07 '16 at 09:33
the web config elements didn't do anything for me, but `SaveSigninToken = true` turned out to be critical for me. Thank you! – bkwdesign Aug 08 '18 at 16:08

score 3 · Answer 2 · answered Jan 22 '13 at 18:43

I ran into this problem when hosting in IIS Express. It turns out that the issue was my browser - I had not closed all of my browser windows or cleared cookies, so the SessionSecurityToken was not being recreated with the new setting, even though the server had been restarted (the existing FedAuth cookie was still being sent from the browser).

Once I forced a re-authentication by closing all browser windows, restarting the browser and performing my request again, the BootstrapContext was present.

Mohammad Sepahvand · Answer 3 · 2014-08-12T08:22:11.587

3

If you're using a message handler to manually validate the token using the JwtSecurityTokenHandler to extract a claims principal and attach that to the current Thread, as described here in Using the JWT handler for Implementing “Poor Man”’s Delegation/ActAs, when you're validating the token using JwtSecurityTokenHandler.ValidateToken(), one of the settings on TokenValidationParameters is SaveBootstrapContext, setting that true does the trick.

edited Aug 12 '14 at 08:22

answered Aug 12 '14 at 04:39

Mohammad Sepahvand

17,364
22
81
122

I am using System.IdentityModel.Tokens.Jwt, Version=4.0, but it does not contain SaveBootstrapContext Any idea ? – Homam Oct 19 '17 at 07:20
@Homam I have the same issue and verified `TokenValidationParameters.SaveToken = true` populated theBootstrapContext – Justin Dearing Mar 16 '18 at 13:10

score 0 · Answer 4 · answered Mar 16 '21 at 10:33

0

I'm using Microsoft.AspNetCore.Authentication.OpenIdConnect, Version=5.0.4.0, and the setting is this:

.AddOpenIdConnect(o =>
{
    // . . .
    o.TokenValidationParameters.SaveSigninToken = true;
})

answered Mar 16 '21 at 10:33

Craig Boland

984
1
10
18

BootstrapContext is null on ClaimsIdentity

4 Answers4

Linked