Identity Server Windows Authentication Claims

Question

I am trying to configure Identity 4 server to work with my API project. At this moment I can request token but I need to add user name and role to payload. I tried with IProfileService but no action was performed. How can I obtain this information from windows authentication? Here is my configuration:

launchSettings.json

"iisSettings": {
  "windowsAuthentication": true, 
  "anonymousAuthentication": false 

Program.cs

public static IWebHostBuilder CreateWebHostBuilder(string[] args) =>
        WebHost.CreateDefaultBuilder(args)
            .UseKestrel()
            .UseIISIntegration()
            .UseStartup<Startup>();

Startup.cs

        services.Configure<IISOptions>(iis =>
        {
            iis.AutomaticAuthentication = true;
        });

        var builder = services.AddIdentityServer()
              .AddInMemoryIdentityResources(IdentityResourcesConfig.Get())
              .AddInMemoryApiResources(ApiResourcesConfig.Get())
              .AddInMemoryClients(ClientsConfig.Get());

ClientsConfig.cs

        return new Client[]
        {
            new Client
            {
                ClientId = "XYC",
                AllowedGrantTypes = GrantTypes.ClientCredentials,
                AllowedScopes = { "XYC" },
                RequireClientSecret = false,
                AlwaysIncludeUserClaimsInIdToken = true
            }
        };

Answer 1

I only worked with normal authentication but the classes that are creating and controll the way the claims are shared to other applications should be the same.

You probably just need to add the Claims to the API ressource because by default the claims used by the client will be not inlcuded into the Access Token also given to the client to request an API.

    public static IEnumerable<ApiResource> GetApis()
    {
        return new ApiResource[]
        {
             new ApiResource("MyApi", "This is my Api name", new List<string> {
                    "mynameclaimclaimname", 

             }),

the claim name you add in there is Name of claim. If this is not working it would be helpful to give us further information. How are the API Ressources configured ( IdentityServer side and client side)? Or do you try to configure an API as Client?

Answer 2

The first point is in IdentityServer, Windows authentication is an external provider (as opposed to the IS native authentication cookie). Windows authentication is triggered by using the ChallengeAsync API on the HttpContext using the scheme Windows .You can click here for details.

Another point is you are using client credential flow, which is wrong in your scenario. Client credential flow use app's identity, there is no user in it.