Consider creating a workaround for serialization of netfx ClaimsPrincipal

[rockfordlhotka]

As per this thread: #1868 (reply in thread)

There appears to be a bug in the netfx implementation of ClaimsPrincipal where it can't deserialize from a byte stream created by the same type. The behavior works as expected in netstandard, but not netfx.

Currently MobileFormatter uses the CslaClaimsPrincipal type to "wrap" any ClaimsPrincipal found in an object graph so serialization of the principal/identity is possible. Similarly, MobileFormatter has special code to deserialize the ClaimsPrincipal byte array to rehydrate the principal/identity during deserialization.

That behavior relies on ClaimsPrincipal properly serializing/deserializing itself, and so fails in netfx.

Possible solution

A possible solution would be to have a netfx-specific bit of code in MobileFormatter and/or CslaClaimsPrincipal to manually pull out all settable property values from the principal, and all the claims from the identity, and to put them into a serializable temp object graph, which would then be serialized into a byte array. On deserialization, that temp object graph would be rehydrated, and could be used to create a new principal/identity object pair.

Whether this would actually work is unknown. Research is required.

[rockfordlhotka]

Possible solution based on the following idea:

using System;
using System.Collections.Generic;
using System.Linq;
using System.Security.Claims;

namespace ClaimsPrincipalSerialize
{
    internal class Program
    {
        static void Main(string[] args)
        {
            var principal = new ClaimsPrincipal(new ClaimsIdentity(
            [
                new Claim(ClaimTypes.Name, "John Doe"),
                new Claim(ClaimTypes.Email, "Abdul Ahad")
            ]));
            ((ClaimsIdentity)principal.Identity).Label = "My Identity Label";

            var serialized = SerializePrincipal(principal);
            var deserialized = DeserializePrincipal(serialized);
            Console.WriteLine(deserialized.Identity.Name);
            Console.WriteLine(((ClaimsIdentity)deserialized.Identity).Label);
            foreach (var claim in deserialized.Claims)
            {
                Console.WriteLine($"{claim.Type}: {claim.Value}");
            }
            Console.ReadLine();
        }

        //private static byte[] SerializePrincipal(ClaimsPrincipal principal)
        //{
        //    using var buffer = new System.IO.MemoryStream();
        //    using var writer = new System.IO.BinaryWriter(buffer);
        //    principal.WriteTo(writer);
        //    return buffer.ToArray();
        //}
        private static string SerializePrincipal(ClaimsPrincipal principal)
        {
            var identity = (ClaimsIdentity)principal.Identity;
            var dto = new PrincipalDto
            {
                Identity = new IdentityDto
                {
                    AuthenticationType = principal.Identity.AuthenticationType,
                    Label = identity.Label,
                    Claims = identity.Claims.Select(c => new ClaimDto
                    {
                        Type = c.Type,
                        Value = c.Value,
                        ValueType = c.ValueType
                    }).ToList()
                }
            };
            return System.Text.Json.JsonSerializer.Serialize(dto);
        }

        //private static ClaimsPrincipal DeserializePrincipal(byte[] bytes)
        //{
        //    using var buffer = new System.IO.MemoryStream(bytes);
        //    using var reader = new System.IO.BinaryReader(buffer);
        //    return new ClaimsPrincipal(reader);
        //}

        private static ClaimsPrincipal DeserializePrincipal(string json)
        {
            var dto = System.Text.Json.JsonSerializer.Deserialize<PrincipalDto>(json);
            var claims = dto.Identity.Claims.Select(c => new Claim(c.Type, c.Value, c.ValueType)).ToList();
            var identity = new ClaimsIdentity(claims, dto.Identity.AuthenticationType)
            {
                Label = dto.Identity.Label
            };
            return new ClaimsPrincipal(identity);
        }
    }

    public class PrincipalDto
    {
        public IdentityDto Identity { get; set; }
    }

    public class IdentityDto
    {
        public string AuthenticationType { get; set; }
        public string Label { get; set; }
        public List<ClaimDto> Claims { get; set; }
    }

    public class ClaimDto
    {
        public string Type { get; set; }
        public string Value { get; set; }
        public string ValueType { get; set; }
    }
}

[rockfordlhotka]

Once #2531 is complete, we should be able to use that technique to solve the ClaimsPrincipal issue in a clean manner.

[github-actions]

This issue has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.