Using Claims Types properly in Owin Identity and Asp.Net MVC

Question

I am using Owin and Identity and I am having a problem with Claims.

I have applications where users use an email to authenticate and others that use an username.

1. The sign in method in the business layer can accept an Email or an Username depending on the case.

2. To "obfuscate" the user identity I use a GUID, unique to each user, when displaying a page with user info.

   I also use this because sometimes an email or an username can be a problem in the url ...

When I sign a user I have the following claims types:

new Claim(ClaimTypes.Email, user.Email), new Claim(ClaimTypes.Name, user.FullName), new Claim(ClaimTypes.GivenName, user.FirstName), new Claim(ClaimTypes.Surname, user.LastName), new Claim(ClaimTypes.NameIdentifier, user.UserUniqueIdentifier.ToString()) 

So my interpretation is:

Email is the user's email  Name is the user's full name  GivenName is the user's first name  Surname is the user's last name  NameIdentifier is the user's unique identifier ... It can be the email, the username or in this case I am using an Unique ID. 

What is strange is there is no Claim Type for Username. Where would to place it?

Basically it seems there is a problem when a Username is not used as the Unique name identifier but it is still necessary.

Is something wrong with my logic claims types?

Answer 1

ClaimTypes.Name (http:// schemas.xmlsoap.org/ws/2005/05/identity/claims/name) should be used for the username.

ClaimTypes.NameIdentifier is typically used for the user's id. In some cases it could be a username.

ASP.NET Identity uses ClaimTypes.Name to store the username, and ClaimTypes.NameIdentifier to store the primary key GUID of the user.

Answer 2

If you examine what Facebook or Google return from oAuth you will see that ClaimTypes.Name is ClaimTypes.GivenName + ClaimTypes.Surname. LinkedIn returns then concatenated and I believe this is a bug because I have a completely different username there. Twitter returns username for ClaimTypes.Name, but Twitter is a special case and they do not even return email.

All of them are using some opaque numeric identifier for ClaimTypes.NameIdentifier. And they use their own string names, usually starting with urn:facebook:link, urn:google:profile, etc for custom data.

Asp.NET Identity model uses UserName for ClaimTypes.Name. The bottom line is that ClaimTypes.Name is used differently in practice. You could add any claim name as a string and could add the urn:... scheme to make it unambiguous.