OAuth: ASP.NET Web API User.Identity doesn't load claims set by authentication token provider

Question

I am using OAuth bearer authentication, configured like this in Startup.cs:

        OAuthBearerAuthenticationOptions oAuthBearerOptions = 
            new OAuthBearerAuthenticationOptions
            {
                AccessTokenProvider = new AccessTokenProvider(),
                AuthenticationMode = AuthenticationMode.Active
            };
        app.UseOAuthBearerAuthentication(oAuthBearerOptions);

... where AccessTokenProvider is implemented as:

public class AccessTokenProvider : AuthenticationTokenProvider
{
    public override async Task ReceiveAsync(AuthenticationTokenReceiveContext context)
    {
        // Internal logic to get data needed for building identity...

        // Create claims identity
        ClaimsIdentity identity = new ClaimsIdentity(identityName);
        identity.AddClaim(new Claim(ClaimTypes.NameIdentifier, nameIdentifier));
        // Add other claims

        // Set claims identity
        context.SetTicket(new AuthenticationTicket(identity, new AuthenticationProperties()));
    }
}

If I set a breakpoint at the end of ReceiveAsync, I can verify that the identity is built correctly (has claims) and that SetTicket is reached.

But when I try to access the identity from a Web API controller:

public abstract class BaseStorageController : ApiController
{
    protected IStorageService StorageService;

    protected BaseStorageController(IStorageServiceFactory storageServiceFactory)
    {
        StorageService = storageServiceFactory.CreateStorageService(User.Identity as ClaimsIdentity);
    }

}

... the list of claims on the identity is empty!

What can be causing this?

Side note: I don't know if this is related, but I am using Castle Windsor as an IOC container to inject dependencies into my controllers (in the above case, IStorageServiceFactory). The above seemed to work (claims were not empty) before I added that. However, I'm not using CW to manage anything related to authentication. Here is my CW installer for api controllers:

public class ApiControllerInstaller : IWindsorInstaller
{
    public void Install(IWindsorContainer container, IConfigurationStore store)
    {
        container.Register(Classes.FromThisAssembly().BasedOn<ApiController>().LifestylePerWebRequest());
    }
}

score 3 · Accepted Answer · edited May 23 '17 at 11:45

I found the answer. It was not related to dependency injection/inversion of control. I'm not sure how I thought it was working prior to adding that.

The issue is similar to what is described here (but in my case the solution is different): User (IPrincipal) not avaliable on ApiController's constructor using Web Api 2.1 and Owin

Basically IPrincipal is not accessible from the constructor of the api controller, which is why there are no claims (the user is not yet authenticated). User.Identity is only accessible from the controller's actions, not the constructor. I changed my base controller implementation to the following to get around this issue:

public abstract class BaseStorageController : ApiController
{
    private readonly IStorageServiceFactory _storageServiceFactory;
    private IStorageService _storageService;

    protected BaseStorageController(IStorageServiceFactory storageServiceFactory)
    {
        _storageServiceFactory = storageServiceFactory;
    }

    protected IStorageService StorageService
    {
        get
        {
            if (_storageService == null)
            {
                _storageService = _storageServiceFactory.CreateStorageService(User.Identity as ClaimsIdentity);
            }
            return _storageService;
        }
    }
}

Since StorageService is only accessed from controller actions, User.Identity is authenticated and has claims populated by the time that the StorageService getter gets called.

Hope this helps someone!

Thanks!!! I had the constructor issue going on all day and tried multiple different authprovider implementations. This solved it. — Rasmus Christensen, May 08 '15 at 13:01

score 0 · Answer 2 · edited May 23 '17 at 12:16

0

 protected IStorageService StorageService
{
    get
    {
        if (_storageService == null)
        {
            _storageService = _storageServiceFactory.CreateStorageService(User.Identity as ClaimsIdentity);
        }
        return _storageService;
    }
}

this is not the best approach for implementing DI

It's much better to use constructor injection. Check Constructor Injection in C#/Unity? if you are not familliar with Unity, follow this link, very useful: https://msdn.microsoft.com/en-us/library/dn223671(v=pandp.30).aspx

Regards

edited May 23 '17 at 12:16

Community

1
1

answered Sep 01 '15 at 13:40

Boris Malaichik

89
1
2

The IPrincipal is not available in the constructor of a web api controller which means constructor injection doesn't work in this case. – lucuma Jan 13 '17 at 01:20

OAuth: ASP.NET Web API User.Identity doesn't load claims set by authentication token provider

2 Answers2