Where to place logic adding additional claims obtained via an alternate REST endpoint

[ryanewtaylor]

This is a question. I hope this is the appropriate place to ask this.

I am working with the AspNet.Security.OAuth.ArcGIS provider and everything is working quite well. However, I need to add additional claims from an alternate endpoint, specifically the portal/sharing/rest/community/users/{username} endpoint. Here we are able to determine the groups that the user belongs to and add various claims based on those groups.

Would an appropriate place to put this logic be in OnCreatingTicket?

I will need to issue a new GET with the recently obtained username and access token and await its response.

Is there a better location to place this custom logic?

[martincostello]

OnCreatingTicket is a good option to add extra claims - for example, I've used it to add extra claims when logging in with GitHub based on the user's organisations.