5

I've been looking for an exact answer but it seems most answers are client call and out of the scope.

Question: I already have an access token access token. How to get a claim using c# code given an access token ONLY?

I think: Below are the same questions but no answers i think fits.

How to get the claims out of a authenticated SecurityToken

How do I read claims from my Oauth token?

Community
  • 1
  • 1
choopau
  • 2,209
  • 5
  • 21
  • 28
  • For clarification: You want to, on the server, identify a user's claims given only his bearer token? – J.N. May 08 '17 at 03:19
  • yes would that be possible? – choopau May 08 '17 at 03:37
  • What about this one? http://stackoverflow.com/questions/26357054/return-more-info-to-the-client-using-oauth-bearer-tokens-generation-and-owin-in – J.N. May 08 '17 at 03:39
  • It is. I've tried to decode my token in https://jwt.io/ and that includes. – choopau May 08 '17 at 03:41
  • I edited my last comment before you posted your answer - take a look a the link in that comment, that might help you. – J.N. May 08 '17 at 03:45
  • Can you access Request.GetOwinContext().Authentication.User.Claims? –  May 08 '17 at 19:59

2 Answers2

6

Install-Package Newtonsoft.Json

The access token is just base64 encoded JSON. You can parse the token as follows

        string token =
            "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWV9.TJVA95OrM7E2cBab30RMHrHDcEfxjoYZgeFONFh7HgQ";
        var parts = token.Split('.');
        var decoded = Convert.FromBase64String(parts[1]);
        var part = Encoding.UTF8.GetString(decoded);
        var jwt = JObject.Parse(part);
        var name = jwt["name"].Value<string>();

UPDATE

  1. Parsing access token on the client is not recommended, access token should be parsed only on the resource server.
  2. You must validate the access token on the resource server to make sure that token has not tampered on the way.

  3. Most of the time you dont need to parse token as above, Just use a recommended JWT library that does both validation and parsing. e.g.

    app.UseOAuthBearerAuthentication(new OAuthBearerAuthenticationOptions());

rawel
  • 2,923
  • 21
  • 33
0

rawel provided a very handy sample! One small problem I encountered were the namespaces, I had to use (just to make this easier to find for the next person, since I cannot post comments yet):

using System.Text;
using Newtonsoft.Json.Linq
Michael Lintschinger
  • 61
  • 5
  • This does not really answer the question. If you have a different question, you can ask it by clicking [Ask Question](https://stackoverflow.com/questions/ask). To get notified when this question gets new answers, you can [follow this question](https://meta.stackexchange.com/q/345661). Once you have enough [reputation](https://stackoverflow.com/help/whats-reputation), you can also [add a bounty](https://stackoverflow.com/help/privileges/set-bounties) to draw more attention to this question. - [From Review](/review/late-answers/29997093) – Hamed Hajiloo Oct 05 '21 at 09:15