Closed blowdart closed 5 years ago
@jmprieur The token_id_hint looks like it's based on the whole identity, including roles. What should we be building the token_id_hint from?
Oh dear;
"Previously issued ID Token passed to the logout endpoint as a hint about the End-User's current authenticated session with the Client."
Which is what we're doing.
Which is correct - maybe dumping everything and the kitchen sink into id_token wasn't a very good idea to start with ;)
would it be possible to compress the IDToken ?
That would require support for decompression on the other side, and throwing the standards out the window. So .. no.
Could you hydrate the groups as part of claims transformation instead via the graph apis?
Do all claims have to be present in a hint?
Previously issued ID Token passed to the logout endpoint as a hint about the End-User's current authenticated session with the Client.
Yes, because you've put them all in the ID token the server issued.
It's possible to advise not to add groups to the token, and use the Graph API later. You would set the groupMembershipClaims
property of the Application Manifest to None.
Then to read the groups from the graph you can see this sample: https://github.com/Azure-Samples/active-directory-dotnet-webapp-groupclaims
Closing because no further action is planned on this issue. This is how OIDC works and it is best to try to keep tokens to a smaller size.
From @xenalite on October 13, 2018 7:11
I am using this sample: https://github.com/Azure-Samples/active-directory-dotnet-webapp-openidconnect-aspnetcore
I made 1 modification in the code - added
SaveTokens
flag:I also made another modification in the AAD app manifest:
"groupMembershipClaims": "SecurityGroup",
This gives me a longer ID token with group claims as I need them, but when I try to sign out, I get this:![image](https://user-images.githubusercontent.com/4509839/46902540-1fa85100-cebf-11e8-82b2-c9f3f8c8a419.png)
Message: AADSTS90015: Requested query string is too long.
The signout URL is:
The
id_token_hint
is very long. Is it required, or can it be omittted somehow?What I'm trying to do ultimately:
To that end, I modified my app code and manifest even further from the sample:
App manifest additions:![image](https://user-images.githubusercontent.com/4509839/46902696-51221c00-cec1-11e8-8734-ae7a57a9b7f8.png)
"oauth2AllowImplicitFlow": true,
This allows me to get an access token for Azure Service Management in my controller like so:
var accessToken = await httpContext.GetTokenAsync("access_token");
Copied from original issue: aspnet/Identity#2010