Master Claims Transformation for Flexible JWT Auth in ASP.NET Core

Claims-based authorization mechanisms are central to modern authorization in ASP.NET Core. However, the access tokens your Identity Provider (IDP) issued might not always perfectly align with your application's internal authorization needs. External IDPs like Microsoft Entra ID (previously Azure AD) or Auth0 might have their own schema for claims or might not directly issue all the claims your application needs for its authorization logic. The solution? Claims transformation.

Claims transformation allows you to modify the claims before the application uses them for authorization. In this video, I'll show you how to implement a custom claims transformation for flexible authorization policies.

Master Claims Transformation for Flexible ASP.NET Core Authorization

Join my weekly .NET newsletter:

Read my Blog here:

Chapters
0:00 What is Claims Transformation?
2:12 Configuring JWT Auth in ASP.NET Core
3:42 Getting a valid JWT with dotnet user-jwts
5:57 Implementing Claims Transformation
9:38 Adding a custom Authorization policy
11:01 Testing the custom Claims Transformation
12:14 RBAC in a Modular Monolith with Claims Transformation

[Cesar-qijb]

All your videos are right on time 🤩
We use Microsoft Entra ID for authentication. However, we plan on building our own access control API and make use of claims transformations. We use Redis as cache.

[ulvidemirsoy]

Great work, what is the advantages compared to adding claims directly into jwt?

[maacpiash]

Great video. I just have one question: if I need to access the database in the claims transformation process, where should I do it? In the implementation of IClaimsTransformation interface, or in the permission provider class?

[baudeejay]

Inventory management with redis. I like you with it

[vamvdotnet]

Excellent video! I learned a lot from you today :)

[EvekoShadow]

Does this work well with dynamic claims? Let’s say a CreateOrder Claim but said user can only create them for his department

[haroldpepete]

great video, but in this case the normal user has the same permission than a user with a standard plan, he or she just need to be registered, even tough it was a great concept, you take the CreateScope and GetRequiredSerrvice from my comment?

[abdulmoiz]

interesting solution. the problem is that that this only works in a monolith.
if you have 2 apis 1 .net and 1 python, then this logic will not work here. rather i think permissions should be part of the access token claims. in this way it won't matter what programming language I'm using, I'll be able to extract the permissions from the access token

[rusektor]

How does this differ from ClaimsPrincipalFactory?

[sunzhang-dv]

Sorry, but what should be stored in Infrastructure and Persistence?

[sunzhang-dv]

我想知道 Infrastructure 和 Presentation 中应该存储哪些内容？

[RaZziaN]

Really good video, except i dislike minimal api, but other than that great.