Nrthugu

I have the following for my login code, and another method to retrieve the user ID in another call.

        // POST: /api/Account/Login

    [HttpPost]

    [AllowAnonymous]

    public async Task<IActionResult> Login([FromBody]LoginViewModel model)

    {

        if (ModelState.IsValid)

        {

            var user = await _userManager.FindByEmailAsync(model.Email);

            if (user != null)

            {

                if (!await _userManager.IsEmailConfirmedAsync(user))

                {

                    ModelState.AddModelError(string.Empty, 

                                "You must have a confirmed email to log in.");

                    return BadRequest(Errors.AddErrorToModelState("Email", "You must have a confirmed email to log in.", ModelState));

                }

            }



            var result = await _signInManager.PasswordSignInAsync(model.Email, model.Password, model.RememberMe, lockoutOnFailure: false);



            if (result.Succeeded)

            {

                // IS THIS NEEDED? --> // HttpContext.User = await _userClaimsPrincipalFactory.CreateAsync(user);

                var tokens = _antiforgery.GetAndStoreTokens(HttpContext);



                var identity = _jwtFactory.GenerateClaimsIdentity(model.Email, user.Id);

                _logger.LogInformation(1, "User logged in.");

                var jwt = await Tokens.GenerateJwt(identity, _jwtFactory, model.Email, _jwtOptions, new JsonSerializerSettings { Formatting = Formatting.Indented });

                return new OkObjectResult(jwt);

            }



            if (result.RequiresTwoFactor)

            {

                //return RedirectToAction(nameof(SendCode), new { ReturnUrl = returnUrl, RememberMe = model.RememberMe });

            }



            if (result.IsLockedOut)

            {

                string message = "User account locked out.";

                _logger.LogWarning(2, message);

                return BadRequest(Errors.AddErrorToModelState("Email", message, ModelState));

            }



            if (result.IsNotAllowed)

            {

                string message = "User account is not allowed to sign in.";

                _logger.LogWarning(2, message);

                return BadRequest(Errors.AddErrorToModelState("Email", message, ModelState));

            }



            return BadRequest(Errors.AddErrorToModelState("", "Sign in failed.", ModelState));

        }



        return BadRequest(Errors.AddErrorToModelState("", "", ModelState));            

    }



    public string GetUserId()

    {

        string username = string.Empty;



        ClaimsPrincipal principal = HttpContext.User as ClaimsPrincipal;  



        if (HttpContext.User != null)

        {

            var id = HttpContext.User.FindFirst(ClaimTypes.NameIdentifier);



            if (id != null)

            {

                username = id.Value;

            }

        }



        return username;

    }

This is the code for GenerateJwt. (Are these fields standard? I see other fields being set in other code, such as in https://code-maze.com/authentication-aspnetcore-jwt-1/.)

  public static async Task<string> GenerateJwt(ClaimsIdentity identity, IJwtFactory jwtFactory,string userName, JwtIssuerOptions jwtOptions, JsonSerializerSettings serializerSettings)

  {

    var response = new

    {

      id = identity.Claims.Single(c => c.Type == "id").Value,

      auth_token = await jwtFactory.GenerateEncodedToken(userName, identity),

      expires_in = (int)jwtOptions.ValidFor.TotalSeconds

    }; // see GenerateEncodedToken pasted below.



    return JsonConvert.SerializeObject(response, serializerSettings);

  }



    public async Task<string> GenerateEncodedToken(string userName, ClaimsIdentity identity)

    {

        var claims = new

     {

             new Claim(JwtRegisteredClaimNames.Sub, userName),

             new Claim(JwtRegisteredClaimNames.Jti, await _jwtOptions.JtiGenerator()),

             new Claim(JwtRegisteredClaimNames.Iat, ToUnixEpochDate(_jwtOptions.IssuedAt).ToString(), ClaimValueTypes.Integer64),

             identity.FindFirst(Helpers.Constants.Strings.JwtClaimIdentifiers.Rol),

             identity.FindFirst(Helpers.Constants.Strings.JwtClaimIdentifiers.Id)

         };



        // Create the JWT security token and encode it.

        var jwt = new JwtSecurityToken(

            issuer: _jwtOptions.Issuer,

            audience: _jwtOptions.Audience,

            claims: claims,

            notBefore: _jwtOptions.NotBefore,

            expires: _jwtOptions.Expiration,

            signingCredentials: _jwtOptions.SigningCredentials);



        var encodedJwt = new JwtSecurityTokenHandler().WriteToken(jwt);



        return encodedJwt;

    }

These are the relevant lines in ConfigureServices.

  // jwt wire up

  // Get options from app settings

  var jwtAppSettingOptions = Configuration.GetSection(nameof(JwtIssuerOptions));



  // Configure JwtIssuerOptions

  services.Configure<JwtIssuerOptions>(options =>

  {

    options.Issuer = jwtAppSettingOptions[nameof(JwtIssuerOptions.Issuer)];

    options.Audience = jwtAppSettingOptions[nameof(JwtIssuerOptions.Audience)];

    options.SigningCredentials = new SigningCredentials(_signingKey, SecurityAlgorithms.HmacSha256);

  });



  var tokenValidationParameters = new TokenValidationParameters

  {

    ValidateIssuer = true,

    ValidIssuer = jwtAppSettingOptions[nameof(JwtIssuerOptions.Issuer)],



    ValidateAudience = true,

    ValidAudience = jwtAppSettingOptions[nameof(JwtIssuerOptions.Audience)],



    ValidateIssuerSigningKey = true,

    IssuerSigningKey = _signingKey,



    RequireExpirationTime = false,

    ValidateLifetime = true,

    ClockSkew = TimeSpan.Zero

  };



  services.AddAuthentication(options =>

  {

    options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;

    options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;



  }).AddJwtBearer(configureOptions =>

  {

    configureOptions.ClaimsIssuer = jwtAppSettingOptions[nameof(JwtIssuerOptions.Issuer)];

    configureOptions.TokenValidationParameters = tokenValidationParameters;

    configureOptions.SaveToken = true;

    configureOptions.RequireHttpsMetadata = false;

  });



  // api user claim policy

  services.AddAuthorization(options =>

  {

    options.AddPolicy("ApiUser", policy => policy.RequireClaim(Constants.Strings.JwtClaimIdentifiers.Rol, Constants.Strings.JwtClaims.ApiAccess));

  });



  // add identity

  var builder = services.AddIdentity<AppUser, AppRole>(o =>

  {

    // configure identity options

    o.Password.RequireDigit = false;

    o.Password.RequireLowercase = false;

    o.Password.RequireUppercase = false;

    o.Password.RequireNonAlphanumeric = false;

    o.Password.RequiredLength = 6;

  })

  .AddSignInManager<SignInManager<AppUser>>()

  .AddEntityFrameworkStores<AppIdentityDbContext>()

  .AddDefaultTokenProviders();

I'm using the following to pass my token from Angular.

  private authHeader(): HttpHeaders {

  let headers = new HttpHeaders();

  if (isPlatformBrowser(this.platformId)) {

    headers = headers.set('Content-Type', 'application/json');

    let authToken = this.windowRefService.nativeWindow.localStorage.getItem('auth_token');

    headers = headers.set('Authorization', authToken);

    headers = headers.set('X-XSRF-TOKEN', this.getCookie('XSRF-TOKEN'));

  }



  return headers;

}



  protected jsonAuthRequestOptions = { headers: this.authHeader() };



public loggedInAs(): Observable<string> {

    return this.http.post<any>(this.baseUrl + "api/Account/GetUserId", { } , this.jsonAuthRequestOptions)

    .map(data => {

        if (data) {

            return data;

        }



        return '';

    })

    .catch(this.handleError);

}

Does JWT authentication automatically set HttpContext.User? Or do I have to do that explicitly?

My succeeding call fails. (User has no claims, though HttpContext.User is not null.) I don't know whether the problem is with relying on HttpContext.User, or whether there is something wrong with the token generation / consumption.