How can I see what claims are coming through with Identity authentication?

When setting up a site for third-party authentication, such as Federation Authentication, ADFS, Active Directory, Azure AD, etc, once a user is logged in, can I inspect the values/claims coming from the single-sign on provider?

Answer

An easy way to do this is to add a temporary end-point in your Start Up class and inspect the user there. For example:

            app.Map("/whoami", map =>
            {
                map.Run(ctx =>
                {
                    var claimsIdentity = ((ClaimsIdentity)ctx.Request.User.Identity);
                    var output = string.Join("\n", claimsIdentity.Claims.Select(x => $"{x.Type}: {x.Value}"));

                    ctx.Response.ContentType = "text/plain";
                    ctx.Response.StatusCode = 200;
                    ctx.Response.Write(output);
                    return Task.FromResult(0);
                });
            });

You can set a breakpoint inside the Run lambda and then hit /whoami to trigger a request. Then inspect the claimsIdentity object with the debugger. This example also outputs all the claims and their values as text to the browser.

Just be sure to remove this code when you're done debugging and don't allow this to get to production.