Complex claims in JWT
<p>The <a href="https://www.rfc-editor.org/rfc/rfc7519" rel="nofollow noreferrer">JWT RFC</a> does not seem to have any problem containing complex arrays such as:</p>
<pre><code>{
    &quot;email&quot;: &quot;test@test.com&quot;,
    &quot;businesses&quot;: [
        {
            &quot;businessId&quot;: &quot;1&quot;,
            &quot;businessName&quot;: &quot;One&quot;,
            &quot;roles&quot;: [
                  &quot;admin&quot;,
                  &quot;accountant&quot;
            ]
        },
        {
            &quot;businessId&quot;: &quot;2&quot;,
            &quot;businessName&quot;: &quot;Two&quot;,
            &quot;roles&quot;: [
                  &quot;support&quot;
            ]
        }
     ]
}
</code></pre>
<p>And this seems a desirable scenario for our needs, since as part of the token we'd like to have a list of businesses a user has access to and what roles does he have for each business (it's part of its identity). The authorization policies at the API would later understand those groups and apply the required authorization logic.</p>
<p>I have seen that with IdentityServer4 the claims are added to the <code>ProfileDataRequestContext</code>'s <code>IEnumerable&lt;Claim&gt; IssuedClaims</code> property.</p>
<p>Is there any recommended alternative to this complex claim structure? If not, is there any way to build that structure with IdentityServer4 (maybe some extension?) or the only way would be to manually serialize the JSON since the Claim seems to accept only a string?</p>
<p>PS: I have seen <a href="https://stackoverflow.com/questions/22317492">this question</a> and <a href="https://stackoverflow.com/questions/24813709">this other</a> where one of the authors of Identity Server talks about something similar being an antipattern. Not sure if the antipattern would be to have complex claims' structure or &quot;authorization implementation details&quot; in the claims.</p>
<p>Any advice on this would be great!</p>
<p><strong>UPDATE:</strong></p>
<p>After giving some thoughts I agree having a complex hierarchy of claims is not desirable and I could go around this problem with a dirty solution of prefixing roles for each businessId. Something like this:</p>
<pre><code>{
    &quot;email&quot;: &quot;test@test.com&quot;,
    &quot;roles&quot;: [
        &quot;1_admin&quot;,
        &quot;1_accountant&quot;,
        &quot;2_support&quot;
     ],
     &quot;businesses&quot;: [
        &quot;1_One&quot;,
        &quot;2_Two&quot; 
     ]
}
</code></pre>
<p>that way I keep a simple structure and later on, at the client or API I can read the claims and find out that <code>1</code> is the id for the business with name <code>One</code> and it has the roles <code>admin</code> and <code>account</code>.</p>
<p><strong>Would this be a better solution?</strong></p>