{"action":"created","issue":{"url":"https://api.github.com/repos/aspnet/Security/issues/1760","repository_url":"https://api.github.com/repos/aspnet/Security","labels_url":"https://api.github.com/repos/aspnet/Security/issues/1760/labels{/name}","comments_url":"https://api.github.com/repos/aspnet/Security/issues/1760/comments","events_url":"https://api.github.com/repos/aspnet/Security/issues/1760/events","html_url":"https://github.com/aspnet/Security/issues/1760","id":324042074,"node_id":"MDU6SXNzdWUzMjQwNDIwNzQ=","number":1760,"title":"RequireClaim Helper for Scope Claim?","user":{"login":"spottedmahn","id":14079228,"node_id":"MDQ6VXNlcjE0MDc5MjI4","avatar_url":"https://avatars0.githubusercontent.com/u/14079228?v=4","gravatar_id":"","url":"https://api.github.com/users/spottedmahn","html_url":"https://github.com/spottedmahn","followers_url":"https://api.github.com/users/spottedmahn/followers","following_url":"https://api.github.com/users/spottedmahn/following{/other_user}","gists_url":"https://api.github.com/users/spottedmahn/gists{/gist_id}","starred_url":"https://api.github.com/users/spottedmahn/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/spottedmahn/subscriptions","organizations_url":"https://api.github.com/users/spottedmahn/orgs","repos_url":"https://api.github.com/users/spottedmahn/repos","events_url":"https://api.github.com/users/spottedmahn/events{/privacy}","received_events_url":"https://api.github.com/users/spottedmahn/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/aspnet/Security/milestones/12","html_url":"https://github.com/aspnet/Security/milestone/12","labels_url":"https://api.github.com/repos/aspnet/Security/milestones/12/labels","id":1300196,"node_id":"MDk6TWlsZXN0b25lMTMwMDE5Ng==","number":12,"title":"Discussions","description":"","creator":{"login":"Eilon","id":202643,"node_id":"MDQ6VXNlcjIwMjY0Mw==","avatar_url":"https://avatars3.githubusercontent.com/u/202643?v=4","gravatar_id":"","url":"https://api.github.com/users/Eilon","html_url":"https://github.com/Eilon","followers_url":"https://api.github.com/users/Eilon/followers","following_url":"https://api.github.com/users/Eilon/following{/other_user}","gists_url":"https://api.github.com/users/Eilon/gists{/gist_id}","starred_url":"https://api.github.com/users/Eilon/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Eilon/subscriptions","organizations_url":"https://api.github.com/users/Eilon/orgs","repos_url":"https://api.github.com/users/Eilon/repos","events_url":"https://api.github.com/users/Eilon/events{/privacy}","received_events_url":"https://api.github.com/users/Eilon/received_events","type":"User","site_admin":false},"open_issues":13,"closed_issues":50,"state":"open","created_at":"2015-09-10T22:38:46Z","updated_at":"2018-06-28T21:30:36Z","due_on":null,"closed_at":null},"comments":5,"created_at":"2018-05-17T14:13:43Z","updated_at":"2018-07-05T13:00:15Z","closed_at":null,"author_association":"NONE","body":"If I want to verify 🚦 the [scope claim](https://tools.ietf.org/html/rfc6749#section-3.3) in my Web API, I can't use the helper [`RequireClaim()`](https://docs.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.authorization.authorizationpolicybuilder.requireclaim?view=aspnetcore-2.0) as the claim value is a space delimited list.\r\n\r\nI can do this:\r\n\r\n```csharp\r\nservices.AddAuthorization(options =>\r\n{\r\n    options.AddPolicy(\"ScopeCheck\", policyBuilder => \r\n     policyBuilder\r\n     .RequireAssertion(async handler =>\r\n       {\r\n           var scopeClaim = handler.User.FindFirst(\"http://schemas.microsoft.com/identity/claims/scope\");\r\n           var scopes = scopeClaim?.Value.Split(' ');\r\n           var hasScope = scopes?.Where(scope => scope == \"demo.write\").Any() ?? false;\r\n           return hasScope;\r\n       }));\r\n});\r\n```\r\n\r\n---\r\n\r\nWhat about helper method for this?  Something like `RequireScope(\"some.scope\")`?\r\n\r\nThoughts 💭?\r\n\r\nReference: [SO Thread](https://stackoverflow.com/a/50393047/185123)"},"comment":{"url":"https://api.github.com/repos/aspnet/Security/issues/comments/402713768","html_url":"https://github.com/aspnet/Security/issues/1760#issuecomment-402713768","issue_url":"https://api.github.com/repos/aspnet/Security/issues/1760","id":402713768,"node_id":"MDEyOklzc3VlQ29tbWVudDQwMjcxMzc2OA==","user":{"login":"spottedmahn","id":14079228,"node_id":"MDQ6VXNlcjE0MDc5MjI4","avatar_url":"https://avatars0.githubusercontent.com/u/14079228?v=4","gravatar_id":"","url":"https://api.github.com/users/spottedmahn","html_url":"https://github.com/spottedmahn","followers_url":"https://api.github.com/users/spottedmahn/followers","following_url":"https://api.github.com/users/spottedmahn/following{/other_user}","gists_url":"https://api.github.com/users/spottedmahn/gists{/gist_id}","starred_url":"https://api.github.com/users/spottedmahn/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/spottedmahn/subscriptions","organizations_url":"https://api.github.com/users/spottedmahn/orgs","repos_url":"https://api.github.com/users/spottedmahn/repos","events_url":"https://api.github.com/users/spottedmahn/events{/privacy}","received_events_url":"https://api.github.com/users/spottedmahn/received_events","type":"User","site_admin":false},"created_at":"2018-07-05T13:00:15Z","updated_at":"2018-07-05T13:00:15Z","author_association":"NONE","body":"Ah, really good point.  The claim type could be different... didn't know about that.  Thanks 🙏\r\n\r\nWhat if that the scope type is passed in?  Thoughts? 💭\r\n\r\n```csharp\r\n\r\npublic static bool RequireScope(this PolicyBuilder policyBuilder, string scopeValue, string scopeType = \"scope\")\r\n{\r\n    ...\r\n}\r\n\r\n//usage\r\nservices.AddAuthorization(options =>\r\n{\r\n    options.AddPolicy(\"ScopeCheck\", policyBuilder => \r\n     policyBuilder.RequireScope(\"some.scope.value\");\r\n\r\n    options.AddPolicy(\"ScopeCheck\", policyBuilder => \r\n     policyBuilder.RequireScope(\"some.scope.value2\", \"http://schemas.microsoft.com/identity/claims/scope\");\r\n});\r\n```\r\n\r\n"}}
{"actor":{"display_login":"spottedmahn"}}