title: ASP.Net Core JWT Login not setting HttpContext.User.Claims
body: <p>I have the following for my login code, and another method to retrieve the user ID in another call.</p>
  
  <pre><code>        // POST: /api/Account/Login
      [HttpPost]
      [AllowAnonymous]
      public async Task&lt;IActionResult&gt; Login([FromBody]LoginViewModel model)
      {
          if (ModelState.IsValid)
          {
              var user = await _userManager.FindByEmailAsync(model.Email);
              if (user != null)
              {
                  if (!await _userManager.IsEmailConfirmedAsync(user))
                  {
                      ModelState.AddModelError(string.Empty, 
                                  "You must have a confirmed email to log in.");
                      return BadRequest(Errors.AddErrorToModelState("Email", "You must have a confirmed email to log in.", ModelState));
                  }
              }
  
              var result = await _signInManager.PasswordSignInAsync(model.Email, model.Password, model.RememberMe, lockoutOnFailure: false);
  
              if (result.Succeeded)
              {
                  // IS THIS NEEDED? --&gt; // HttpContext.User = await _userClaimsPrincipalFactory.CreateAsync(user);
                  var tokens = _antiforgery.GetAndStoreTokens(HttpContext);
  
                  var identity = _jwtFactory.GenerateClaimsIdentity(model.Email, user.Id);
                  _logger.LogInformation(1, "User logged in.");
                  var jwt = await Tokens.GenerateJwt(identity, _jwtFactory, model.Email, _jwtOptions, new JsonSerializerSettings { Formatting = Formatting.Indented });
                  return new OkObjectResult(jwt);
              }
  
              if (result.RequiresTwoFactor)
              {
                  //return RedirectToAction(nameof(SendCode), new { ReturnUrl = returnUrl, RememberMe = model.RememberMe });
              }
  
              if (result.IsLockedOut)
              {
                  string message = "User account locked out.";
                  _logger.LogWarning(2, message);
                  return BadRequest(Errors.AddErrorToModelState("Email", message, ModelState));
              }
  
              if (result.IsNotAllowed)
              {
                  string message = "User account is not allowed to sign in.";
                  _logger.LogWarning(2, message);
                  return BadRequest(Errors.AddErrorToModelState("Email", message, ModelState));
              }
  
              return BadRequest(Errors.AddErrorToModelState("", "Sign in failed.", ModelState));
          }
  
          return BadRequest(Errors.AddErrorToModelState("", "", ModelState));            
      }
  
      public string GetUserId()
      {
          string username = string.Empty;
  
          ClaimsPrincipal principal = HttpContext.User as ClaimsPrincipal;  
  
          if (HttpContext.User != null)
          {
              var id = HttpContext.User.FindFirst(ClaimTypes.NameIdentifier);
  
              if (id != null)
              {
                  username = id.Value;
              }
          }
  
          return username;
      }
  </code></pre>
  
  <p>This is the code for GenerateJwt. (Are these fields standard? I see other fields being set in other code, such as in <a href="https://code-maze.com/authentication-aspnetcore-jwt-1/" rel="noreferrer">https://code-maze.com/authentication-aspnetcore-jwt-1/</a>.)</p>
  
  <pre><code>  public static async Task&lt;string&gt; GenerateJwt(ClaimsIdentity identity, IJwtFactory jwtFactory,string userName, JwtIssuerOptions jwtOptions, JsonSerializerSettings serializerSettings)
    {
      var response = new
      {
        id = identity.Claims.Single(c =&gt; c.Type == "id").Value,
        auth_token = await jwtFactory.GenerateEncodedToken(userName, identity),
        expires_in = (int)jwtOptions.ValidFor.TotalSeconds
      }; // see GenerateEncodedToken pasted below.
  
      return JsonConvert.SerializeObject(response, serializerSettings);
    }
  
      public async Task&lt;string&gt; GenerateEncodedToken(string userName, ClaimsIdentity identity)
      {
          var claims = new[]
       {
               new Claim(JwtRegisteredClaimNames.Sub, userName),
               new Claim(JwtRegisteredClaimNames.Jti, await _jwtOptions.JtiGenerator()),
               new Claim(JwtRegisteredClaimNames.Iat, ToUnixEpochDate(_jwtOptions.IssuedAt).ToString(), ClaimValueTypes.Integer64),
               identity.FindFirst(Helpers.Constants.Strings.JwtClaimIdentifiers.Rol),
               identity.FindFirst(Helpers.Constants.Strings.JwtClaimIdentifiers.Id)
           };
  
          // Create the JWT security token and encode it.
          var jwt = new JwtSecurityToken(
              issuer: _jwtOptions.Issuer,
              audience: _jwtOptions.Audience,
              claims: claims,
              notBefore: _jwtOptions.NotBefore,
              expires: _jwtOptions.Expiration,
              signingCredentials: _jwtOptions.SigningCredentials);
  
          var encodedJwt = new JwtSecurityTokenHandler().WriteToken(jwt);
  
          return encodedJwt;
      }
  </code></pre>
  
  <p>These are the relevant lines in ConfigureServices.</p>
  
  <pre><code>  // jwt wire up
    // Get options from app settings
    var jwtAppSettingOptions = Configuration.GetSection(nameof(JwtIssuerOptions));
  
    // Configure JwtIssuerOptions
    services.Configure&lt;JwtIssuerOptions&gt;(options =&gt;
    {
      options.Issuer = jwtAppSettingOptions[nameof(JwtIssuerOptions.Issuer)];
      options.Audience = jwtAppSettingOptions[nameof(JwtIssuerOptions.Audience)];
      options.SigningCredentials = new SigningCredentials(_signingKey, SecurityAlgorithms.HmacSha256);
    });
  
    var tokenValidationParameters = new TokenValidationParameters
    {
      ValidateIssuer = true,
      ValidIssuer = jwtAppSettingOptions[nameof(JwtIssuerOptions.Issuer)],
  
      ValidateAudience = true,
      ValidAudience = jwtAppSettingOptions[nameof(JwtIssuerOptions.Audience)],
  
      ValidateIssuerSigningKey = true,
      IssuerSigningKey = _signingKey,
  
      RequireExpirationTime = false,
      ValidateLifetime = true,
      ClockSkew = TimeSpan.Zero
    };
  
    services.AddAuthentication(options =&gt;
    {
      options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
      options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
  
    }).AddJwtBearer(configureOptions =&gt;
    {
      configureOptions.ClaimsIssuer = jwtAppSettingOptions[nameof(JwtIssuerOptions.Issuer)];
      configureOptions.TokenValidationParameters = tokenValidationParameters;
      configureOptions.SaveToken = true;
      configureOptions.RequireHttpsMetadata = false;
    });
  
    // api user claim policy
    services.AddAuthorization(options =&gt;
    {
      options.AddPolicy("ApiUser", policy =&gt; policy.RequireClaim(Constants.Strings.JwtClaimIdentifiers.Rol, Constants.Strings.JwtClaims.ApiAccess));
    });
  
    // add identity
    var builder = services.AddIdentity&lt;AppUser, AppRole&gt;(o =&gt;
    {
      // configure identity options
      o.Password.RequireDigit = false;
      o.Password.RequireLowercase = false;
      o.Password.RequireUppercase = false;
      o.Password.RequireNonAlphanumeric = false;
      o.Password.RequiredLength = 6;
    })
    .AddSignInManager&lt;SignInManager&lt;AppUser&gt;&gt;()
    .AddEntityFrameworkStores&lt;AppIdentityDbContext&gt;()
    .AddDefaultTokenProviders();
  </code></pre>
  
  <p>I'm using the following to pass my token from Angular.</p>
  
  <pre><code>  private authHeader(): HttpHeaders {
    let headers = new HttpHeaders();
    if (isPlatformBrowser(this.platformId)) {
      headers = headers.set('Content-Type', 'application/json');
      let authToken = this.windowRefService.nativeWindow.localStorage.getItem('auth_token');
      headers = headers.set('Authorization', authToken);
      headers = headers.set('X-XSRF-TOKEN', this.getCookie('XSRF-TOKEN'));
    }
  
    return headers;
  }
  
    protected jsonAuthRequestOptions = { headers: this.authHeader() };
  
  public loggedInAs(): Observable&lt;string&gt; {
      return this.http.post&lt;any&gt;(this.baseUrl + "api/Account/GetUserId", { } , this.jsonAuthRequestOptions)
      .map(data =&gt; {
          if (data) {
              return data;
          }
  
          return '';
      })
      .catch(this.handleError);
  }
  </code></pre>
  
  <p>Does JWT authentication automatically set HttpContext.User? Or do I have to do that explicitly?</p>
  
  <p>My succeeding call fails. (User has no claims, though HttpContext.User is not null.) I don't know whether the problem is with relying on HttpContext.User, or whether there is something wrong with the token generation / consumption.</p>