options.ClaimActions.Remove("given_name") not working

[Coder3333]

Is there an existing issue for this?

• I have searched the existing issues

Describe the bug

When I call options.ClaimActions.Remove("given_name") on an OpenIdConnectOptions, I do not get "given_name" as a claim. "given_name" is definitely in the JWT, and if I use options.MapInboundClaims = false, then "given_name" does show up in the claims, but it also disables any claim mappings that I have set.

Expected Behavior

"given_name" would be added to my identity's claims.

Steps To Reproduce

Call options.ClaimActions.Remove("given_name") when "given_name" is in the JWT.

Exceptions (if any)

No response

.NET Version

8

Anything else?

When I call options.ClaimActions.Remove("given_name"), I do see the "given_name" action removed from options.ClaimActions that is set by the constructor of OpenIdConnectOptions, but it doesn't seem to help, as "given_name" still does not show up in my claims, where "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname" is in my claims, but not my JWT.

I see that if I call Microsoft.IdentityModel.JsonWebTokens.JsonWebTokenHandler.DefaultInboundClaimTypeMap.Remove("given_name"), that it works and the "given_name" claim shows up, even without calling options.ClaimActions.Remove("given_name"). Is this the way this is expected to work? Shouldn't the call to ClaimActions.Remove take precedence over the default?

Ultimately, I want "given_name" to show up as a claim if it is in my JWT. What is the correct way to do this? I thought that it would be to call options.ClaimActions.Remove("given_name"), but maybe that is not how this feature was designed.

[MackinnonBuck]

@Coder3333, what identity provider are you using?

You could try setting GetClaimsFromUserInfoEndpoint to true.

If that doesn't work, a minimal repro demonstrating the problem would help us investigate the issue further.

[Coder3333]

@Coder3333, what identity provider are you using?

You could try setting GetClaimsFromUserInfoEndpoint to true.

If that doesn't work, a minimal repro demonstrating the problem would help us investigate the issue further.

I am just using AddOpenIdConnect and connecting to Azure B2C as the idp. The JWT has all of the expected attributes, including "given_name", but it keeps getting mapped to an alternate claim name.