ASP.NET Core enrich IIdentity with custom profile

Question

I am using Azure AD to authorize and authenticate the users. All users have a profile in the database.

I would like on login to always "merge" the Azure user with my database user.

This is the code I am using to setup authentication in my web api.

public static partial class ServiceCollectionExtensions
{
    public static IServiceCollection AddBearerAuthentication(this IServiceCollection services,
        OpenIdConnectOptions openIdConnectOptions)
    {
    #if DEBUG
        IdentityModelEventSource.ShowPII = true;
    #endif

        services
            .AddAuthentication("Bearer")
            .AddJwtBearer("Bearer", o =>
            {
                o.Authority = openIdConnectOptions.Authority;
                o.TokenValidationParameters.ValidIssuer = openIdConnectOptions.ValidIssuer;
                o.TokenValidationParameters.ValidAudiences = openIdConnectOptions.ValidAudiences;
            });

        return services;
    }
}

Can someone point me in the right direction? Right now I am loading the user in all of my controllers, not pretty at all.

Answer 1

Not sure what do you mean by "merge" the user. But if it's just some logic you want to run for every incoming http request, you could just add a custom middleware

app.Use(async (context, next) =>
{
    var user = await context.RequestServices
                            .GetRequiredService<DatabaseContext>()
                            .Users
                            .Where(....)
                            .SingleOrDefaultAsync();
    ...
    await next(context);
});

Alternatively, if you want to couple your code with the authentication process very much, you could use the callback from JwtBearerOptions

.AddJwtBearer("Bearer", o =>
{
    ...
    o.Events.OnTokenValidated = async context =>
    {
        var user = await context.HttpContext
                                .RequestServices
                                .GetRequiredService....
        ...
    };
}

But personally, I think both approaches are bad. Going to the DB to get the user's credentials with every request is bad for performance. Also, it kinda defies the whole point of the JWT, which was designed specifically to not do that. The token should already contain all the claims inside. If it doesn't, I would suggest reconfiguring azure AD, or switch to self-issued tokens.