Only one claim of type 'role' is returned to the hub

Describe the bug

I am using Azure SignalR via server-side blazor, and am running into an issue where all but one of my ‘role’ claims are being dropped.

I understand that, as per this issue, claims will be duplicated under an alias if they are present in the default JWT claim type mapping. The issue only seems to occur when there are multiple claims of a type which will be aliased. For example:

HttpContext Claims

sub = userid
email = [e-mail]
role = Role1
role = Role2
role = Role3
role = Role4

Hub Claims

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier = userid
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress = [e-mail]
http://schemas.microsoft.com/ws/2008/06/identity/claims/role = Role1
http://schemas.microsoft.com/ws/2008/06/identity/claims/role = Role2
http://schemas.microsoft.com/ws/2008/06/identity/claims/role = Role3
http://schemas.microsoft.com/ws/2008/06/identity/claims/role = Role4
sub = userid
email = [e-mail]
role = Role1

Here, all roles are present in there aliased form, but only the first has been un-aliased

To Reproduce

Have a HttpContext user as follows:

var user = new ClaimsPrincipal(new ClaimsIdentity(new[] {
    new Claim("sub", "userId"),
    new Claim("email", "[e-mail]"),
    new Claim("role", "Role1"),
    new Claim("role", "Role2"),
    new Claim("role", "Role3"),
    new Claim("role", "Role4"),
}, authenticationType: "Any", nameType: "name" roleType: "role");

Further technical details

• Your Azure SignalR SDK version: 1.5.1
• Your Server ASPNETCORE version or Assembly version of Microsoft.AspNetCore.SignalR: 3.1
• Your SignalR Client SDK version: 3.1 (unsure, using this via blazor server on AspNetCore 3.1)

[alanbucknum]

Thanks, that makes sense. For now we are just modifying the list of role claims to a single role claim, which contains a pipe-delimited list of roles (e.g. “admin|superadmin|reportsconsumer”). Then our authenticating filter for SignalR parses the string back into a list of individual roles to check against allowed permissions.

[vicancy]

Thanks for pointing out the issue. We indeed only handle the first one, this involves service side change and we will fix it in the next deployment cycle which is scheduled to be one month later.