使用ASOS的访问令牌中的自定义用户数据

Question

I'm trying to impement the OpenID Connect server using AspNet.Security.OpenIdConnect.Server .

Is it possible to place some custom user data to the access token when issuing token at authorization Server and then retrieve it at Resource Server during token validation and request processing?

Example: I want to write to the access token an IP address that was used to get token by user. Then at the resource server I want to compare current user IP address and IP address from token during token validation.

Another example: I want to write user's roles to token and then retrieve them in WebApi action filter or action itself

Answer 1

Consider simply storing the IP address as a claim:

identity.AddClaim("ip_addr", HttpContext.Connection.RemoteIpAddress.ToString(),
    OpenIdConnectConstants.Destinations.AccessToken);

Then, in your API controller, retrieve it using:

var address = User.FindFirst("ip_addr").Value;