title: How do I add a custom claim to authentication cookie generated by OpenIdConnect middleware in ASP.Net Core after authentication?
body: <p>I have an ASP.Net Core application project which uses IdentityServer4 Hybrid Auth Flow. It is setup as follows,</p>
  
  <pre><code>public void ConfigureServices(IServiceCollection services)
  {
      services.Configure&lt;CookiePolicyOptions&gt;(options =&gt;
      {
          // This lambda determines whether user consent for non-essential cookies is needed for a given request.
          options.CheckConsentNeeded = context =&gt; true;
          options.MinimumSameSitePolicy = SameSiteMode.None;
      });
  
      services.AddMvc().SetCompatibilityVersion(CompatibilityVersion.Version_2_2);
  
      JwtSecurityTokenHandler.DefaultInboundClaimTypeMap.Clear();
  
      services.AddAuthentication(options =&gt;
      {
          options.DefaultScheme = "Cookies";
          options.DefaultChallengeScheme = "oidc";
      }).AddCookie("Cookies")
        .AddOpenIdConnect("oidc", options =&gt;
        {   
            options.Authority = IdentityServerUrl;
            options.RequireHttpsMetadata = false;
  
            options.ClientId = ClientId;
            options.ClientSecret = ClientSecret;
            options.ResponseType = "code id_token";
            options.SaveTokens = true;
  
            options.GetClaimsFromUserInfoEndpoint = true;
            options.Scope.Add("openid");
            options.Scope.Add("profile");
            options.Scope.Add("email");
            options.Scope.Add("offline_access");
            options.Scope.Add("ApiAuthorizedBasedOnIdentity");
            options.GetClaimsFromUserInfoEndpoint = true;
            options.TokenValidationParameters.NameClaimType = JwtClaimTypes.Name;
            options.TokenValidationParameters.RoleClaimType = JwtClaimTypes.Role;                  
        });
  
      //Setup Tenant Role based authorization
      services.AddSingleton&lt;IAuthorizationPolicyProvider, AuthorizationPolicyProvider&gt;();
  
      services.AddProxy();
  }
  </code></pre>
  
  <p>I'm able to authenticate and SaveTokens=true successfully saves the access token in the ASP.Net authentication cookie. Now I need to add a custom claim to this same authentication cookie from within a Controller Action (<strong>Not via a middleware</strong>) in my ASP.Net Core client project. Let's say the Index action of HomeController for example.</p>
  
  <p>I also need this claim to persist in the authentication cookie so that it will persist across requests and controller actions.</p>
  
  <p>I did some digging around and noticed that I could do this with ASP.Net Identity</p>
  
  <pre><code>if (User.Identity.IsAuthenticated)
  {
      var claimsIdentity = ((ClaimsIdentity)User.Identity);
      if (!claimsIdentity.HasClaim(c =&gt; c.Type == "your-claim"))
      {
          ((ClaimsIdentity)User.Identity).AddClaim(new Claim("your-claim", "your-value"));
  
          var appUser = await userManager.GetUserAsync(User).ConfigureAwait(false);
          await signInManager.RefreshSignInAsync(appUser).ConfigureAwait(false);
      }
  }
  </code></pre>
  
  <p>Authentication is done by the IdentityServer using ASP.Net Identity which is setup in that project. However to use SignInManager, UserManager, etc. in the client project I will need to bring in ASP.Net Identity into it.  Setting up ASP.Net identity and stores in the client project also, just to update the authentication cookie with an additional claim seems like overkill. Is there any other way to do this?</p>