From 56bb869955361067362d1603349369c26e00968c Mon Sep 17 00:00:00 2001
From: maliming <malimings@gmail.com>
Date: Mon, 30 Jun 2025 13:47:56 +0800
Subject: [PATCH] Add `sid` claim to openiddict's `principal`.

---
 .../Pages/Index.cshtml                        | 21 +++++++++++++++++++
 .../OpenIddict.Demo.Server/Pages/Index.cshtml | 14 +++++++++----
 .../Controllers/AuthorizeController.cs        | 15 +++++++++++++
 3 files changed, 46 insertions(+), 4 deletions(-)

diff --git a/modules/openiddict/app/OpenIddict.Demo.Client.Mvc/Pages/Index.cshtml b/modules/openiddict/app/OpenIddict.Demo.Client.Mvc/Pages/Index.cshtml
index dc32cca59c..ea4a9f3347 100644
--- a/modules/openiddict/app/OpenIddict.Demo.Client.Mvc/Pages/Index.cshtml
+++ b/modules/openiddict/app/OpenIddict.Demo.Client.Mvc/Pages/Index.cshtml
@@ -15,17 +15,38 @@
     @if (HttpContext.User.Identity != null && HttpContext.User.Identity.IsAuthenticated)
     {
         <ul class="list-group mt-3 text-start">
+            <p>Current User</p>
             @foreach (var claim in HttpContext.User.Claims)
             {
                 <li class="list-group-item">@claim.Type : @claim.Value</li>
             }
         </ul>
 
+        <ul class="list-group mt-3 text-start">
+            <p>oidc</p>
+            @{
+                var oidc = await HttpContext.AuthenticateAsync("oidc");
+                if (oidc.Principal != null)
+                {
+                    foreach (var claim in oidc.Principal.Claims)
+                    {
+                        <li class="list-group-item">@claim.Type : @claim.Value</li>
+                    }
+                }
+            }
+        </ul>
+
+
         <p>HttpContext.GetTokenAsync("access_token")
             <br/>
             @await HttpContext.GetTokenAsync("access_token")
         </p>
 
+        <p>HttpContext.GetTokenAsync("id_token")
+            <br/>
+            @await HttpContext.GetTokenAsync("id_token")
+        </p>
+
         var client = new HttpClient();
         var request = new HttpRequestMessage(HttpMethod.Get, "https://localhost:44303/api/claims");
         request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", await HttpContext.GetTokenAsync("access_token"));
diff --git a/modules/openiddict/app/OpenIddict.Demo.Server/Pages/Index.cshtml b/modules/openiddict/app/OpenIddict.Demo.Server/Pages/Index.cshtml
index fd28464cc7..daa3ee9b95 100644
--- a/modules/openiddict/app/OpenIddict.Demo.Server/Pages/Index.cshtml
+++ b/modules/openiddict/app/OpenIddict.Demo.Server/Pages/Index.cshtml
@@ -4,7 +4,13 @@
     ViewData["Title"] = "Home page";
 }
 
-<div class="text-center">
-    <h1 class="display-4">Welcome</h1>
-    <p>Learn about <a href="https://docs.microsoft.com/aspnet/core">building Web apps with ASP.NET Core</a>.</p>
-</div>
\ No newline at end of file
+@if (HttpContext.User.Identity != null && HttpContext.User.Identity.IsAuthenticated)
+{
+    <ul class="list-group mt-3 text-start">
+        <p>Current User</p>
+        @foreach (var claim in HttpContext.User.Claims)
+        {
+            <li class="list-group-item">@claim.Type : @claim.Value</li>
+        }
+    </ul>
+}
diff --git a/modules/openiddict/src/Volo.Abp.OpenIddict.AspNetCore/Volo/Abp/OpenIddict/Controllers/AuthorizeController.cs b/modules/openiddict/src/Volo.Abp.OpenIddict.AspNetCore/Volo/Abp/OpenIddict/Controllers/AuthorizeController.cs
index 5c2f6ef996..a8350e22e5 100644
--- a/modules/openiddict/src/Volo.Abp.OpenIddict.AspNetCore/Volo/Abp/OpenIddict/Controllers/AuthorizeController.cs
+++ b/modules/openiddict/src/Volo.Abp.OpenIddict.AspNetCore/Volo/Abp/OpenIddict/Controllers/AuthorizeController.cs
@@ -1,5 +1,6 @@
 using System;
 using System.Collections.Generic;
+using System.IdentityModel.Tokens.Jwt;
 using System.Linq;
 using System.Security.Claims;
 using System.Text.Encodings.Web;
@@ -148,6 +149,13 @@ public class AuthorizeController : AbpOpenIdDictControllerBase
             case OpenIddictConstants.ConsentTypes.Explicit when authorizations.Any() && !request.HasPromptValue(OpenIddictConstants.PromptValues.Consent):
                 var principal = await SignInManager.CreateUserPrincipalAsync(user);
 
+                var sid = dynamicPrincipal.FindFirst(JwtRegisteredClaimNames.Sid);
+                if (sid != null)
+                {
+                    principal.RemoveClaims(JwtRegisteredClaimNames.Sid);
+                    principal.AddClaim(JwtRegisteredClaimNames.Sid, sid.Value);
+                }
+
                 if (result.Properties != null && result.Properties.IsPersistent)
                 {
                     var claim = new Claim(AbpClaimTypes.RememberMe, true.ToString()).SetDestinations(OpenIddictConstants.Destinations.AccessToken);
@@ -247,6 +255,13 @@ public class AuthorizeController : AbpOpenIdDictControllerBase
 
         var principal = await SignInManager.CreateUserPrincipalAsync(user);
 
+        var sid = User.FindFirst(JwtRegisteredClaimNames.Sid);
+        if (sid != null)
+        {
+            principal.RemoveClaims(JwtRegisteredClaimNames.Sid);
+            principal.AddClaim(JwtRegisteredClaimNames.Sid, sid.Value);
+        }
+
         var result = await HttpContext.AuthenticateAsync(IdentityConstants.ApplicationScheme);
         if (result.Succeeded && result.Properties != null && result.Properties.IsPersistent)
         {