Return givename and surname claims from Facebook provider by default.

[mikes-gh]

I know things are really busy round here so don't spend too much time looking at this. @Tratcher
Its a bit nitty.
If you don't think this is going anywhere please close.

I would like to (re)present my reasons for this.

• We are not really requesting any more information than name already provides but it is very useful to have givenname and surname separated from a programming perspective.
• First name and last name are actually pretty useful for the user site registration process and splitting the full name is not always straight forward e.g. Jesus De Souza
• Facebook and Google are by far the 2 most used social logins. It would be consistent for the providers to return the same set of http://schemas.xmlsoap.org/ws/2005/05/identity/ claims
• New developers that have never seen the source code may take a while to discover they need to add fields to Facebook options to get first_name and last_name (probably save a bit of forum traffic).
• The only impact this will have is a few more bytes in the request and JSON response for Facebook.
• No more permissions are requested to the Facebook end user (the request for info is still within the already requested scope)
• It requires minimal code change to the Facebook options and that is already tested
• It allows a better abstraction from the implementation of the provider to the end user developer.

Currently

Using the social sample and a minimal setup

Google

  app.UseGoogleAuthentication(new GoogleOptions
            {
                ClientId = Configuration["google:clientid"],
                ClientSecret = Configuration["google:clientsecret"]
            });

Returns

Hello Joe BLogs
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier: 9999999999999999999
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname: Joe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname: Blogs
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name: Joe Blogs
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress: joeblogsf@gmail.com
urn:google:profile: https://plus.google.com/99999999999999999999
Logout

Facebook

            app.UseFacebookAuthentication(new FacebookOptions
            {
                AppId = Configuration["facebook:appid"],
                AppSecret = Configuration["facebook:appsecret"],
            });

returns

Hello Joe Blogs
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier: 956866371056181
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress: joe@blogs.co.uk
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name: Joe Blogs
Logout

Would it make sense to add?

Fields.Add("first_name");
Fields.Add("last_name");

To the Facebook options

[Tratcher]

We want to keep the defaults to minimum required functionality. Google is an interesting comparison, but what do the next 5 do? MSA, Twitter, Yahoo, Github, LinkedIn, etc.. https://github.com/aspnet-contrib/AspNet.Security.OAuth.Providers/tree/dev/src

[mikes-gh]

I used Google as between it and Facebook they hold the 80% market share depending on what sources you look at.
If we are sticking to minimum functional request I wonder if facebook works without any fields in the request

[mikes-gh]

OK I accept your point its hard to be consistent with so many providers doing there own thing.. Out of interest what is the functional minimum for a provider

[mikes-gh]

Looking at the providers there seems a lot of inconsistency in the claims available.
Paypal,Foursquare and Yahoo return givenname and surname.
I guess the difference is with Facebook we have the choice of fields to request.

It seems reasonable and not anymore inconsistent than things already are to request these two fields to align with Google for common scenarios. However if you don't agree that's also a reasonable angle so please close.

[jarrettv]

@mikes-gh I support your issue and appreciate your well thought-out reasoning.

[kevinchalet]

@mikes-gh curious: why closing this thread? You had a valid point.

[mikes-gh]

Reopening as there seems to be some support for this.

[mikes-gh]

Even Microsoft thinks its a good idea to return given name and surname claims by default
https://github.com/aspnet/Security/blob/dev/src/Microsoft.AspNetCore.Authentication.MicrosoftAccount/MicrosoftAccountHelper.cs
also see PR
#691

[Eilon]

We don't think it's a good idea in general for the middleware to alter what a service considers to be its own defaults. If the identity provider changes what it offers, it's a best practice to explicitly add the claims requests or scopes to the auth process.