OrchardCMS/OrchardCore · error · InvalidOperationException

No suitable user identifier can be found in the principal.

Error message

No suitable user identifier can be found in the principal.

What it means

OpenIdExtensions.GetUserIdentifier(ClaimsPrincipal) tries Claims.Subject, ClaimTypes.NameIdentifier, then ClaimTypes.Upn across the principal's claims. When none is present, the chain falls through to throw InvalidOperationException('No suitable user identifier can be found in the principal.').

Solutions

1. Add a subject or NameIdentifier claim to the principal when constructing it (e.g. for the user being authenticated).
2. For application (client-credentials) flows, use the application identifier claim instead of the user identifier API.
3. Fix the identity-provider/user-service claim mapping so 'sub' is emitted in issued tokens.
4. Guard the call site: check FindFirst(Claims.Subject) != null before calling and handle the absence explicitly.

Example fix

// before
var principal = new ClaimsPrincipal(identity);
var userId = principal.GetUserIdentifier(); // throws
// after
identity.AddClaim(new Claim(ClaimTypes.NameIdentifier, user.UserId));
var principal = new ClaimsPrincipal(identity);
var userId = principal.GetUserIdentifier();

if (principal.FindFirst(Claims.Subject) == null &&
    principal.FindFirst(ClaimTypes.NameIdentifier) == null &&
    principal.FindFirst(ClaimTypes.Upn) == null)
{
    throw new InvalidOperationException("Principal lacks any user identifier claim.");
}

bool HasUserIdentifier(ClaimsPrincipal principal) =>
    principal?.FindFirst(Claims.Subject)?.Value != null ||
    principal?.FindFirst(ClaimTypes.NameIdentifier)?.Value != null ||
    principal?.FindFirst(ClaimTypes.Upn)?.Value != null;

try
{
    userId = principal.GetUserIdentifier();
}
catch (InvalidOperationException ex) when (ex.Message.Contains("user identifier"))
{
    // e.g. application-only principal from client credentials — use entity type claim instead
    var entityType = principal.FindFirst(OpenIdConstants.Claims.EntityType)?.Value;
    userId = entityType == OpenIdConstants.EntityTypes.Application ? clientId : null;
}

When it happens

Trigger: Flows like the password/authorization-code exchanges call principal.GetUserIdentifier() on a principal whose token or ticket contains no subject, nameidentifier, or UPN claim.

Common situations: Tokens issued for application-only principals (client credentials) that lack a user subject; external provider mappings dropping NameIdentifier; custom SignIn code that builds a bare ClaimsPrincipal; malformed tokens from third-party issuers.

Related errors

• No suitable user identifier can be found in the identity.
• No suitable user name can be found in the principal.
• An error occurred while pruning authorizations.
• Multiple certificates with the same thumbprint were found.
• The application details cannot be found.

AI-assisted analysis of OrchardCMS/OrchardCore@4306c0717f (2026-09-13). Data as JSON: /api/errors/9c8ddd7768e00bf7. Report an issue: GitHub.

Appendix: source

Thrown at src/OrchardCore.Modules/OrchardCore.OpenId/OpenIdExtensions.cs:18

using System.Security.Claims;
using static OpenIddict.Abstractions.OpenIddictConstants;

namespace OrchardCore.OpenId;

internal static class OpenIdExtensions
{
    internal static string GetUserIdentifier(this ClaimsIdentity identity)
        => identity.FindFirst(Claims.Subject)?.Value ??
           identity.FindFirst(ClaimTypes.NameIdentifier)?.Value ??
           identity.FindFirst(ClaimTypes.Upn)?.Value ??
           throw new InvalidOperationException("No suitable user identifier can be found in the identity.");

    internal static string GetUserIdentifier(this ClaimsPrincipal principal)
        => principal.FindFirst(Claims.Subject)?.Value ??
           principal.FindFirst(ClaimTypes.NameIdentifier)?.Value ??
           principal.FindFirst(ClaimTypes.Upn)?.Value ??
           throw new InvalidOperationException("No suitable user identifier can be found in the principal.");

    internal static string GetUserName(this ClaimsPrincipal principal)
        => principal.FindFirst(Claims.Name)?.Value ??
           principal.FindFirst(ClaimTypes.Name)?.Value ??
           throw new InvalidOperationException("No suitable user name can be found in the principal.");

    internal static string[] GetRoles(this ClaimsPrincipal principal)
        => principal.FindAll(c => c.Type is Claims.Role or ClaimTypes.Role)
        .Select(x => x.Value)
        .Distinct()
        .ToArray();

    internal static async Task<bool> AnyAsync<T>(this IAsyncEnumerable<T> source)
    {
        ArgumentNullException.ThrowIfNull(source);

        await using var enumerator = source.GetAsyncEnumerator();
        return await enumerator.MoveNextAsync();

View on GitHub (pinned to 4306c0717f)