AddingCustomClaimsToAccessTokenInDuende: migrate v6 to Duende.IdentityServer 8.0.5, net10.0 - #2083
Merged
CodeMazeBlog merged 1 commit intoAug 12, 2026
Conversation
…rver 8 on net10.0 Retargets every project to net10.0 and moves the sample from Duende.IdentityServer 6.3.7 to 8.0.5, which is a real v6 -> v8 migration rather than a package bump. IdentityServer v8 changes applied (per Duende's 7.4 -> 8.0 upgrade guide): * Every store/service interface method gained a CancellationToken parameter, so IProfileService.GetProfileDataAsync/IsActiveAsync take one now. * ProfileDataRequestContext.Client was renamed to .Application and retyped to IConnectedApplication, so the client id is read as Application?.Identifier rather than Client.ClientId. * The IdentityModel package/namespace became Duende.IdentityModel. * v8 requires .NET 10; nullable reference types are enabled across the assemblies. Those changes cascade through the whole stock quickstart UI, so Pages/ and wwwroot/ are regenerated from Duende's own v8 in-memory template (Duende.Templates 1.3.0) with the namespace adjusted. That also moves Pages/Home/Error to Pages/Error and swaps bootstrap4-glyphicons for bootstrap-icons. Article content added alongside the migration: * Config.ApiResources declares a "paymentsapi" resource whose UserClaims include the role claim, so Duende requests the role claim type for that audience. * CustomProfileService issues the role claim through AddRequestedClaims, because a custom IProfileService replaces the built-in one and is then the only source of user claims. * A new Api project consumes the token with AddJwtBearer. MapInboundClaims is set to false there: with the default inbound claim mapping the "role" claim arrives under the legacy schemas.microsoft.com URI and RequireRole silently fails. * One test covers the new ApiResource declaration. Verified on .NET SDK 10.0.302 / ASP.NET Core runtime 10.0.10: solution builds in Release, 7/7 tests pass, and an end-to-end authorization-code + PKCE login as alice returns an access token carrying tenant, payments.discount and role claims with paymentsapi in the audience; the role-protected API endpoint answers 200 with the token and 401 without it.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Migrates the quickstart sample from Duende.IdentityServer 6 to 8.0.5 on net10.0. Every store/service interface method gained a CancellationToken parameter; ProfileDataRequestContext.Client renamed to .Application (IConnectedApplication); IdentityModel namespace moved to Duende.IdentityModel. CustomProfileService rewritten (old version does not compile on v8, CS1061 twice). Registers a custom IProfileService and sets MapInboundClaims = false so [Authorize(Roles=...)] works against the JWT's role claim (the default inbound claim mapping renames it otherwise). Quickstart UI scaffold regenerated from Duende.Templates 1.3.0 rather than hand-patched. New minimal Api project added for the article's JWT-bearer block. 7/7 tests pass on net10.0, end-to-end PKCE login verified.