From e5a248e2db6517c37511f1bb5c8f3a209e07a3dd Mon Sep 17 00:00:00 2001 From: Jeremy Kescher Date: Mon, 22 Jun 2026 17:11:02 +0200 Subject: [PATCH] Add ID Austria to the list of supported providers MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Kévin Chalet --- .../OpenIddictClientWebIntegrationHandlers.cs | 22 ++++++++++++++++ ...penIddictClientWebIntegrationProviders.xml | 25 +++++++++++++++++++ 2 files changed, 47 insertions(+) diff --git a/src/OpenIddict.Client.WebIntegration/OpenIddictClientWebIntegrationHandlers.cs b/src/OpenIddict.Client.WebIntegration/OpenIddictClientWebIntegrationHandlers.cs index fb9b86b3..2131a444 100644 --- a/src/OpenIddict.Client.WebIntegration/OpenIddictClientWebIntegrationHandlers.cs +++ b/src/OpenIddict.Client.WebIntegration/OpenIddictClientWebIntegrationHandlers.cs @@ -1515,6 +1515,14 @@ public static partial class OpenIddictClientWebIntegrationHandlers // HubSpot returns the username as a custom "user" node: ProviderTypes.HubSpot => (string?) context.UserInfoResponse?["user"], + // ID Austria doesn't return a username so one is created using the standard "given_name" + // and "family_name" claims extracted from the backchannel or frontchannel identity token: + ProviderTypes.IdAustria + when (context.BackchannelIdentityTokenPrincipal ?? // Always prefer the backchannel identity token when available. + context.FrontchannelIdentityTokenPrincipal) is ClaimsPrincipal principal && + principal.HasClaim(Claims.GivenName) && principal.HasClaim(Claims.FamilyName) + => $"{principal.GetClaim(Claims.GivenName)} {principal.GetClaim(Claims.FamilyName)}", + // Mailchimp returns the username as a custom "accountname" node: ProviderTypes.Mailchimp => (string?) context.UserInfoResponse?["accountname"], @@ -1679,6 +1687,20 @@ public static partial class OpenIddictClientWebIntegrationHandlers } } + // Note: ID Austria doesn't return a stable "sub" claim and encourages clients to use + // the custom "urn:pvpgvat:oidc.bpk" claim to identify users across logins. To ensure + // the WS-Federation name identifier claim returned to the application is stable, + // the "urn:pvpgvat:oidc.bpk" claim is always used instead of the "sub" claim. + // + // For more information, see + // https://www.id-austria.gv.at/de/developer/anbinden/anbindung-mit-openid-connect. + if (context.Registration.ProviderType is ProviderTypes.IdAustria) + { + context.MergedPrincipal.SetClaim(ClaimTypes.NameIdentifier, + context.BackchannelIdentityTokenPrincipal?.GetClaim("urn:pvpgvat:oidc.bpk") ?? + context.FrontchannelIdentityTokenPrincipal?.GetClaim("urn:pvpgvat:oidc.bpk")); + } + return ValueTask.CompletedTask; } } diff --git a/src/OpenIddict.Client.WebIntegration/OpenIddictClientWebIntegrationProviders.xml b/src/OpenIddict.Client.WebIntegration/OpenIddictClientWebIntegrationProviders.xml index f56442fb..f804c3b4 100644 --- a/src/OpenIddict.Client.WebIntegration/OpenIddictClientWebIntegrationProviders.xml +++ b/src/OpenIddict.Client.WebIntegration/OpenIddictClientWebIntegrationProviders.xml @@ -1225,6 +1225,31 @@ + + + + + + + + + + + + + +