re-working claims for aspnet core identity integration and backwards compat

src/Core/Identity/ApiResources.cs

@@ -1,18 +1,19 @@
 using IdentityServer4.Models;
 using System.Collections.Generic;
+using System.Security.Claims;
 
 namespace Bit.Core.Identity
 {
-    public class Resources
+    public class ApiResources
     {
         public static IEnumerable<ApiResource> GetApiResources()
         {
             return new List<ApiResource>
             {
                 new ApiResource("api", "Vault API", new string[] {
-                    "authmethod",
-                    "nameid",
-                    "email",
+                    ClaimTypes.AuthenticationMethod,
+                    ClaimTypes.NameIdentifier,
+                    ClaimTypes.Email,
                     "securitystamp"
                 })
             };

src/Core/Identity/ProfileService.cs

@@ -21,7 +21,7 @@ namespace Bit.Core.Identity
 
         public Task GetProfileDataAsync(ProfileDataRequestContext context)
         {
-            context.AddFilteredClaims(context.IssuedClaims);
+            context.AddFilteredClaims(context.Subject.Claims);
             return Task.FromResult(0);
         }
 

src/Core/Identity/ResourceOwnerPasswordValidator.cs

@@ -1,7 +1,9 @@
 using Bit.Core.Domains;
 using IdentityServer4.Models;
 using IdentityServer4.Validation;
+using Microsoft.AspNetCore.Builder;
 using Microsoft.AspNetCore.Identity;
+using Microsoft.Extensions.Options;
 using System.Security.Claims;
 using System.Threading.Tasks;
 
@@ -10,11 +12,14 @@ namespace Bit.Core.Identity
     public class ResourceOwnerPasswordValidator : IResourceOwnerPasswordValidator
     {
         private readonly UserManager<User> _userManager;
+        private readonly IdentityOptions _identityOptions;
 
         public ResourceOwnerPasswordValidator(
-            UserManager<User> userManager)
+            UserManager<User> userManager,
+            IOptions<IdentityOptions> optionsAccessor)
         {
             _userManager = userManager;
+            _identityOptions = optionsAccessor?.Value ?? new IdentityOptions();
         }
 
         public async Task ValidateAsync(ResourceOwnerPasswordValidationContext context)
@@ -27,10 +32,10 @@ namespace Bit.Core.Identity
                     context.Result = new GrantValidationResult(user.Id.ToString(), "Application", identityProvider: "bitwarden",
                         claims: new Claim[] {
                             // Deprecated claims for backwards compatability
-                            new Claim("authmethod", "Application"),
-                            new Claim("nameid", user.Id.ToString()),
-                            new Claim("email", user.Email.ToString()),
-                            new Claim("securitystamp", user.SecurityStamp)
+                            new Claim(ClaimTypes.AuthenticationMethod, "Application"),
+                            new Claim(_identityOptions.ClaimsIdentity.UserIdClaimType, user.Id.ToString()),
+                            new Claim(_identityOptions.ClaimsIdentity.UserNameClaimType, user.Email.ToString()),
+                            new Claim(_identityOptions.ClaimsIdentity.SecurityStampClaimType, user.SecurityStamp)
                         });
                     return;
                 }

src/Core/Services/IUserService.cs

@@ -8,6 +8,7 @@ namespace Bit.Core.Services
 {
     public interface IUserService
     {
+        Task<User> GetUserByIdAsync(string userId);
         Task<User> GetUserByIdAsync(Guid userId);
         Task SaveUserAsync(User user);
         Task<IdentityResult> RegisterUserAsync(User user, string masterPassword);

src/Core/Services/Implementations/UserService.cs

@@ -57,6 +57,17 @@ namespace Bit.Core.Services
             _passwordValidators = passwordValidators;
         }
 
+        public async Task<User> GetUserByIdAsync(string userId)
+        {
+            Guid userIdGuid;
+            if(!Guid.TryParse(userId, out userIdGuid))
+            {
+                return null;
+            }
+
+            return await _userRepository.GetByIdAsync(userIdGuid);
+        }
+
         public async Task<User> GetUserByIdAsync(Guid userId)
         {
             return await _userRepository.GetByIdAsync(userId);