{"action":"created","issue":{"url":"https://api.github.com/repos/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/issues/415","repository_url":"https://api.github.com/repos/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet","labels_url":"https://api.github.com/repos/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/issues/415/labels{/name}","comments_url":"https://api.github.com/repos/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/issues/415/comments","events_url":"https://api.github.com/repos/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/issues/415/events","html_url":"https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/issues/415","id":156951435,"number":415,"title":"Default 'sub' claim mapping does not resolve to ClaimsPrincipal.Identity.Name","user":{"login":"bgever","id":1618765,"avatar_url":"https://avatars.githubusercontent.com/u/1618765?v=3","gravatar_id":"","url":"https://api.github.com/users/bgever","html_url":"https://github.com/bgever","followers_url":"https://api.github.com/users/bgever/followers","following_url":"https://api.github.com/users/bgever/following{/other_user}","gists_url":"https://api.github.com/users/bgever/gists{/gist_id}","starred_url":"https://api.github.com/users/bgever/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bgever/subscriptions","organizations_url":"https://api.github.com/users/bgever/orgs","repos_url":"https://api.github.com/users/bgever/repos","events_url":"https://api.github.com/users/bgever/events{/privacy}","received_events_url":"https://api.github.com/users/bgever/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/labels/Fix%205.x","name":"Fix 5.x","color":"207de5"},{"url":"https://api.github.com/repos/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/labels/P1","name":"P1","color":"e11d21"},{"url":"https://api.github.com/repos/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/labels/User%20reported","name":"User reported","color":"d4c5f9"}],"state":"open","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/milestones/12","html_url":"https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/milestones/RTM","labels_url":"https://api.github.com/repos/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/milestones/12/labels","id":1678676,"number":12,"title":"RTM","description":"","creator":{"login":"tushargupta51","id":803796,"avatar_url":"https://avatars.githubusercontent.com/u/803796?v=3","gravatar_id":"","url":"https://api.github.com/users/tushargupta51","html_url":"https://github.com/tushargupta51","followers_url":"https://api.github.com/users/tushargupta51/followers","following_url":"https://api.github.com/users/tushargupta51/following{/other_user}","gists_url":"https://api.github.com/users/tushargupta51/gists{/gist_id}","starred_url":"https://api.github.com/users/tushargupta51/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tushargupta51/subscriptions","organizations_url":"https://api.github.com/users/tushargupta51/orgs","repos_url":"https://api.github.com/users/tushargupta51/repos","events_url":"https://api.github.com/users/tushargupta51/events{/privacy}","received_events_url":"https://api.github.com/users/tushargupta51/received_events","type":"User","site_admin":false},"open_issues":22,"closed_issues":9,"state":"open","created_at":"2016-04-01T19:15:32Z","updated_at":"2016-05-26T20:42:50Z","due_on":"2016-06-30T07:00:00Z","closed_at":null},"comments":1,"created_at":"2016-05-26T10:20:09Z","updated_at":"2016-05-28T09:22:01Z","closed_at":null,"body":"To process a JWT, the API consumer is going to use most likely the [`JwtSecurityTokenHandler.ValidateToken`](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/blob/KRelease/src/System.IdentityModel.Tokens.Jwt/JwtSecurityTokenHandler.cs#L504) method, to get a `ClaimsPrincipal`.\r\n\r\n[RFC7519 states for the registered 'sub' claim](https://tools.ietf.org/html/rfc7519#section-4.1.2) (emphasis mine):\r\n\r\n> The \"sub\" (subject) claim **identifies the principal that is the\r\n   subject of the JWT**.  The claims in a JWT are normally statements\r\n   about the subject.  The subject value MUST either be scoped to be\r\n   locally unique in the context of the issuer or be globally unique.\r\n   The processing of this claim is generally application specific.  The\r\n   \"sub\" value is a case-sensitive string containing a StringOrURI\r\n   value.  Use of this claim is OPTIONAL.\r\n\r\nThe `ClaimsPrincipal` object returned from the `ValidateToken` method allows to identify the subject via its default interface with the `Identity.Name` property only. There are no other default properties that expose a *principal identity* unless you'd query the claims.\r\n\r\nBecause the default mapping of the claims controlled with [`ClaimTypeMapping`](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/blob/KRelease/src/System.IdentityModel.Tokens.Jwt/ClaimTypeMapping.cs#L59) links `sub` to `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier`, it does not match with the claim `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name` used to query the `Name` property.\r\n\r\nTherefore, when a JWT has the `sub` claim only, there is no easy API to access its value.\r\n\r\nThe default mapping should be changed to `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name`, so that `ClaimsPrincipal.Identity.Name` resolves to the `sub` claim.\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/issues/comments/222299088","html_url":"https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/issues/415#issuecomment-222299088","issue_url":"https://api.github.com/repos/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/issues/415","id":222299088,"user":{"login":"leastprivilege","id":1454075,"avatar_url":"https://avatars.githubusercontent.com/u/1454075?v=3","gravatar_id":"","url":"https://api.github.com/users/leastprivilege","html_url":"https://github.com/leastprivilege","followers_url":"https://api.github.com/users/leastprivilege/followers","following_url":"https://api.github.com/users/leastprivilege/following{/other_user}","gists_url":"https://api.github.com/users/leastprivilege/gists{/gist_id}","starred_url":"https://api.github.com/users/leastprivilege/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/leastprivilege/subscriptions","organizations_url":"https://api.github.com/users/leastprivilege/orgs","repos_url":"https://api.github.com/users/leastprivilege/repos","events_url":"https://api.github.com/users/leastprivilege/events{/privacy}","received_events_url":"https://api.github.com/users/leastprivilege/received_events","type":"User","site_admin":false},"created_at":"2016-05-28T09:22:01Z","updated_at":"2016-05-28T09:22:01Z","body":"sub is not the name of a user. It's the unique user id."}}
{"actor":{"display_login":"leastprivilege"}}