JsonSubKeyClaim arrays (dotnet#46878)

src/Security/Authentication/OAuth/src/JsonKeyClaimAction.cs

@@ -53,7 +53,7 @@ public override void Run(JsonElement userData, ClaimsIdentity identity, string i
         }
     }
 
-    private void AddClaim(string value, ClaimsIdentity identity, string issuer)
+    private protected void AddClaim(string value, ClaimsIdentity identity, string issuer)
     {
         if (!string.IsNullOrEmpty(value))
         {

src/Security/Authentication/OAuth/src/JsonSubKeyClaimAction.cs

@@ -34,21 +34,28 @@ public JsonSubKeyClaimAction(string claimType, string valueType, string jsonKey,
     /// <inheritdoc />
     public override void Run(JsonElement userData, ClaimsIdentity identity, string issuer)
     {
-        var value = GetValue(userData, JsonKey, SubKey);
-        if (!string.IsNullOrEmpty(value))
+        if (!TryGetSubProperty(userData, JsonKey, SubKey, out var value))
         {
-            identity.AddClaim(new Claim(ClaimType, value, ValueType, issuer));
+            return;
+        }
+        if (value.ValueKind == JsonValueKind.Array)
+        {
+            foreach (var v in value.EnumerateArray())
+            {
+                AddClaim(v.ToString()!, identity, issuer);
+            }
+        }
+        else
+        {
+            AddClaim(value.ToString()!, identity, issuer);
         }
     }
 
     // Get the given subProperty from a property.
-    private static string? GetValue(JsonElement userData, string propertyName, string subProperty)
+    private static bool TryGetSubProperty(JsonElement userData, string propertyName, string subProperty, out JsonElement value)
     {
-        if (userData.TryGetProperty(propertyName, out var value)
-            && value.ValueKind == JsonValueKind.Object && value.TryGetProperty(subProperty, out value))
-        {
-            return value.ToString();
-        }
-        return null;
+        return userData.TryGetProperty(propertyName, out value)
+            && value.ValueKind == JsonValueKind.Object
+            && value.TryGetProperty(subProperty, out value);
     }
 }

src/Security/Authentication/test/ClaimActionTests.cs

@@ -41,6 +41,38 @@ public void CanMapArrayValueUserDataToClaims()
         Assert.Equal("role2", roleClaims[1].Value);
     }
 
+    [Fact]
+    public void CanMapSingleSubValueUserDataToClaim()
+    {
+        var userData = JsonDocument.Parse("{ \"name\": { \"subkey\": \"test\" } }");
+
+        var identity = new ClaimsIdentity();
+
+        var action = new JsonSubKeyClaimAction("name", "name", "name", "subkey");
+        action.Run(userData.RootElement, identity, "iss");
+
+        Assert.Equal("name", identity.FindFirst("name").Type);
+        Assert.Equal("test", identity.FindFirst("name").Value);
+    }
+
+    [Fact]
+    public void CanMapArraySubValueUserDataToClaims()
+    {
+        var userData = JsonDocument.Parse("{ \"role\": { \"subkey\": [ \"role1\", null, \"role2\" ] } }");
+
+        var identity = new ClaimsIdentity();
+
+        var action = new JsonSubKeyClaimAction("role", "role", "role", "subkey");
+        action.Run(userData.RootElement, identity, "iss");
+
+        var roleClaims = identity.FindAll("role").ToList();
+        Assert.Equal(2, roleClaims.Count);
+        Assert.Equal("role", roleClaims[0].Type);
+        Assert.Equal("role1", roleClaims[0].Value);
+        Assert.Equal("role", roleClaims[1].Type);
+        Assert.Equal("role2", roleClaims[1].Value);
+    }
+
     [Fact]
     public void MapAllSucceeds()
     {