Issues with External Login (BankID) #9783

15 Answer(s)

• 

  0

  AI-Bot created one month ago

  Support Team ABP Agent

  1. Forwarding External Claims to JWT (Without Persisting in DB)

  To forward external provider claims (like national identity number, date of birth) into the JWT issued to the Angular client, without persisting them in the database, you need to inject these claims at the token creation stage. The recommended ABP approach is to use a custom IAbpClaimsPrincipalContributor or override the claims principal creation logic, but you must ensure these claims are available at the time the JWT is generated.

  However, since the external cookie is not available in the Angular app (due to different domain/port), you should transfer the required claims from the external identity to the local identity during the external login callback (OnGetExternalLoginCallbackAsync in LoginModel). You can do this by:

  • Reading the external claims from the external login info.
  • Adding the required claims to the ClaimsPrincipal that will be used to generate the JWT (but not persisting them in the user database).
  • Use IAbpClaimsPrincipalContributor to add these claims at runtime, but only if you can access them (e.g., via TempData, session, or a custom mechanism during the login flow).

  Example (in LoginModel.OnGetExternalLoginCallbackAsync):

  var externalLoginInfo = await SignInManager.GetExternalLoginInfoAsync();
  var nationalId = externalLoginInfo.Principal.FindFirst("national_identity_number")?.Value;
  // Store in a temp location (e.g., ClaimsPrincipal, session, or custom claim)
  var claims = new List<Claim>();
  if (!string.IsNullOrEmpty(nationalId))
  {
      claims.Add(new Claim("national_identity_number", nationalId));
  }
  // Pass these claims to the ClaimsPrincipal used for JWT generation
  

  You must ensure these claims are added to the ClaimsPrincipal before the JWT is created. Do not persist them in the database if you want to avoid storage.

  2. Tagging Authentication Method in JWT

  To distinguish between BankID and local login, add a custom claim (e.g., "auth_method": "bankid" or "local") to the ClaimsPrincipal during the login process. This can be done in the same place as above (external login callback or in a custom IAbpClaimsPrincipalContributor).

  Example:

  claims.Add(new Claim("auth_method", "bankid")); // or "local"
  

  This claim will then be included in the JWT and available to your Angular app and API logic.

  Key Points:

  • Claims must be present in the ClaimsPrincipal at the time the JWT is generated.
  • Use the external login callback to transfer claims from the external provider to the local identity.
  • Do not persist sensitive claims in the database; just add them to the ClaimsPrincipal for the current session/token.
  • For tagging authentication type, always add a custom claim during login.

  If you need to customize the OpenIddict token creation pipeline for more advanced scenarios, you can implement a custom grant type or event handler to inject claims at token issuance.

  Sources:

  • ABP Authorization & Claims
  • How to add a custom grant type in OpenIddict
  • GitHub: Custom External Login Provider Example

  ---

  This response was generated by AI. If it didn’t solve your problem, feel free to post a new answer — our support team will jump in to help you soon.

  Save Cancel
• 

  0

  papusa created one month ago

  AI answer didn't solve the problem.

  Save Cancel
• 

  0

  maliming created one month ago

  Support Team Fullstack Developer

  hi

  Can you share a demo project and a test username with password?

  You can create a private GitHub repository and invite https://github.com/maliming

  liming.ma@volosoft.com

  I will change the code and add custom claims.

  Thanks.

  Save Cancel
• 

  0

  papusa created one month ago

  Hi, Thanks for your response.

  Could you clarify the purpose of the demo project? I’m unable to share external provider credentials, so I'm not sure how useful it would be in this case.

  If you’re familiar with retrieving additional claims, perhaps you could share a demo that demonstrates the solution? :)

  Here is how external provider is added in our app:

  private void ConfigureExternalProviders(ServiceConfigurationContext context, IConfiguration configuration)
  {
      var criiptoAuthority = configuration["Authentication:Criipto:Authority"];
      var criiptoClientId = configuration["Authentication:Criipto:ClientId"];
      var criiptoClientSecret = configuration["Authentication:Criipto:ClientSecret"];
      
      context.Services.AddAuthentication()
          .AddOpenIdConnect("Criipto", "BankID", options =>
          {
              options.ClientId = criiptoClientId;
              options.ClientSecret = criiptoClientSecret;
              options.Authority = criiptoAuthority;
              options.ResponseType = OpenIdConnectResponseType.Code;
              options.CallbackPath = new PathString("/signin-bankid");
  
              options.Scope.Add("ssn");
              
              options.ClaimActions.MapJsonKey("socialno", "socialno");
              options.ClaimActions.MapJsonKey("dateofbirth", "dateofbirth");
          });
  }
  

  Save Cancel
• 

  0

  maliming created one month ago

  Support Team Fullstack Developer

  hi

  You can check this case. It's basically the same with you.

  https://abp.io/support/questions/9721/What-is-the-recommended-way-of-making-IdentityExternal-Claims-available-in-IdentityApplication#answer-3a1baf9e-4c09-c9fc-9d6c-c193a681c7bf

  ---

  If you can share a template/demo project, I can add code to test it.

  Thanks.

  Save Cancel
• 

  0

  papusa created one month ago

  Previously, I was using HttpContextAccessor.HttpContext.AuthenticateAsync(IdentityConstants.ExternalScheme) to retrieve the external claims principal.

  After reviewing the link you provided, I switched to using SignInManager, but the behavior hasn't changed. When logging into the Angular app, the external login is null, and I'm not receiving the expected claims when calling the API from the Angular front end.

  Here's the code for my IAbpClaimsPrincipalContributor implementation. Could you please take a look and let me know if there's anything wrong or missing?

  public class BankIdClaimsPrincipalContributor : IAbpClaimsPrincipalContributor, ITransientDependency { private readonly SignInManager<IdentityUser> _signInManager;

  public BankIdClaimsPrincipalContributor(SignInManager<IdentityUser> signInManager)
  {
      _signInManager = signInManager;
  }
  
  public async Task ContributeAsync(AbpClaimsPrincipalContributorContext context)
  {
      var identity = context.ClaimsPrincipal.Identities.FirstOrDefault();
      
      var externalLogin = await _signInManager.GetExternalLoginInfoAsync();
      if (externalLogin == null)
      {
          identity?.AddClaim(new Claim("isbankidauthenticated", false.ToString().ToLower()));
          return;
      }
      
      var authenticationTypeClaim = externalLogin.Principal.FindFirst(Claims.BankId.AuthenticationType);
      var isBankIdAuthenticated = authenticationTypeClaim is { Value: Claims.BankId.NorwegianAuthenticationTypeValue };
      identity?.AddClaim(new Claim("isbankidauthenticated", isBankIdAuthenticated.ToString().ToLower()));
  
      if (!isBankIdAuthenticated)
      {
          return;
      }
  
      ForwardClaim("socialno", "nationalidentitynumber");
      ForwardClaim("dateofbirth", "dateofbirth");
      
      return;
      
      void ForwardClaim(string bankIdClaimType, string claimType)
      {
          var claim = externalLogin.Principal.FindFirst(bankIdClaimType);
          if (claim != null)
          {
              identity?.AddClaim(new Claim(claimType, claim.Value));
          }
      }
  }
  

  }

  ---

  I think it might be more convenient if you could create a demo project yourself with the setup you have in mind. :)

  Save Cancel
• 

  0

  maliming created one month ago

  Support Team Fullstack Developer

  hi

  I can create a demo project, but I don't have an external user account with extra claims.

  That’s why I ask you to share a project and test BankID user info.

  Thanks.

  Save Cancel
• 

  0

  papusa created one month ago

  I can definitely create and share a demo project with you, but please note that I won’t be able to include the external login provider credentials (like the client secret), since those are sensitive. Would that still work for you?

  I can provide a test user (test identity number), or you're welcome to generate one yourself using this link: https://ra-preprod.bankidnorge.no/#/generate We're using Criipto for Norwegian BankID. You can get test account for free.

  That said, I assumed the issue wasn't specific to BankID, and that any external login provider would be sufficient for testing in a demo setup. Please let me know how you'd prefer to proceed!

  Save Cancel
• 

  0

  maliming created one month ago

  Support Team Fullstack Developer

  hi

  I will test your case with GitHub login.

  Is that ok for you?

  You can create an Angular template project and share it with liming.ma@volosoft.com

  Thanks.

  Save Cancel
• 

  0

  papusa created one month ago

  I will test your case with GitHub login.

  Sounds good. Thanks

  Save Cancel
• 

  0

  maliming created one month ago

  Support Team Fullstack Developer

  Please create an Angular template project and share it with liming.ma@volosoft.com

  Thanks.

  Save Cancel
• 

  0

  papusa created one month ago

  I've shared a link to the BankID demo project via OneDrive. You should receive e-mail with link.

  While testing the demo, I noticed that the issue only occurs when an external login is added to an existing user. If the user is registered directly via BankID, the problem doesn't appear.

  Here are the steps to reproduce the issue:

  1. Log in using any local user (e.g., admin).
  2. Navigate to External Logins.
  3. Add an external BankID account using the following test credentials:
     • National identity number: 04080599469
     • One-time code: otp
     • BankID password: qwer1234
  4. After linking the external login, log out.
  5. Log in using BankID.
  6. In the Angular app's Home page, click the "Test national identity claim" button.
  7. Expected: It should display the national identity number. Actual: It shows a message indicating the claim is not found.

  Below is result for same user in angular and swagger:

  Save Cancel
• 

  0

  maliming created one month ago

  Support Team Fullstack Developer

  hi

  Add BankIdOpenIddictServerHandler to your AuthServer project

  

  public override void PreConfigureServices(ServiceConfigurationContext context)
  {
      PreConfigure<OpenIddictServerBuilder>(builder =>
      {
          builder.AddEventHandler(BankIdOpenIddictServerHandler.Descriptor);
      });
  }
  

  using System;
  using System.Threading.Tasks;
  using Microsoft.AspNetCore;
  using Microsoft.AspNetCore.Authentication;
  using Microsoft.AspNetCore.Identity;
  using OpenIddict.Abstractions;
  using OpenIddict.Server;
  
  namespace BankIdDemo;
  
  public class BankIdOpenIddictServerHandler : IOpenIddictServerHandler<OpenIddictServerEvents.ProcessSignInContext>
  {
      public static OpenIddictServerHandlerDescriptor Descriptor { get; }
          = OpenIddictServerHandlerDescriptor.CreateBuilder<OpenIddictServerEvents.ProcessSignInContext>()
              .UseSingletonHandler<BankIdOpenIddictServerHandler>()
              .SetOrder(100_000)
              .SetType(OpenIddictServerHandlerType.Custom)
              .Build();
  
      public async ValueTask HandleAsync(OpenIddictServerEvents.ProcessSignInContext context)
      {
          if (context is { EndpointType: OpenIddictServerEndpointType.Authorization, AuthorizationCodePrincipal: not null})
          {
              var httpContext =  context.Transaction.GetHttpRequest()?.HttpContext;
              if (httpContext == null)
              {
                  return;
              }
  
              var identity = await httpContext.AuthenticateAsync(IdentityConstants.ApplicationScheme);
              if (identity?.Principal == null)
              {
                  return;
              }
  
              var nationalidentitynumber =identity?.Principal?.FindFirst("nationalidentitynumber")?.Value;
              if (!nationalidentitynumber.IsNullOrWhiteSpace())
              {
                  context.AuthorizationCodePrincipal?.AddClaim("nationalidentitynumber", nationalidentitynumber);
              }
              return;
          }
  
          if (context is { EndpointType: OpenIddictServerEndpointType.Token, AccessTokenPrincipal: not null})
          {
              var nationalidentitynumber = context.AccessTokenPrincipal?.FindFirst("nationalidentitynumber")?.Value;
              if (!nationalidentitynumber.IsNullOrWhiteSpace())
              {
                  context.AccessTokenPrincipal?.AddClaim("nationalidentitynumber", nationalidentitynumber);
              }
          }
      }
  }
  
  

  Save Cancel

  1
• 

  0

  papusa created one month ago

  It works. Thank you!

  Save Cancel
• 

  0

  maliming created one month ago

  Support Team Fullstack Developer

  Great!

  Save Cancel