title: ASP.NET requirements for ClaimTypes
body: <p>I'm investigating using claims-based authorization in ASP.NET (MVC Core 1.0).  When setting up a <code>ClaimsIdentity</code>, I supply a list of key/value string pairs to represent each <code>Claim</code>.  Example:</p>
  
  <pre><code>List&lt;Claim&gt; claims = new List&lt;Claim&gt;
  {
      new Claim("UserID", user.ID),
      new Claim("Name", user.Name),
      new Claim("Role", "basic")
  };
  </code></pre>
  
  <p>My understanding is that I can use whatever keys/values I want.  But I noticed there are some pre-defined keys available via the <a href="https://msdn.microsoft.com/en-us/library/system.security.claims.claimtypes%28v=vs.110%29.aspx" rel="noreferrer"><code>ClaimsType</code> class</a>.  So, I could potentially use some of these pre-defined keys instead:</p>
  
  <pre><code>List&lt;Claim&gt; claims = new List&lt;Claim&gt;
  {
      new Claim(ClaimTypes.Sid, user.ID),
      new Claim(ClaimTypes.Name, user.Name),
      new Claim(ClaimTypes.Role, "basic")
  };
  </code></pre>
  
  <p>Questions:</p>
  
  <ol>
  <li><p>If I use the pre-defined keys, are there any rules/restrictions regarding the actual values assigned to each key, or is it application defined?  For example, is it OK to stick a database primary key in <code>ClaimTypes.Sid</code>, or does ASP.NET have certain expectations of what <code>ClaimTypes.Sid</code> should contain?</p></li>
  <li><p>Are there any <code>ClaimTypes</code> that are <strong>required</strong>, or is it completely up to the application to decide what to include or not include?  I imagine the answer may depend on specific third-party authentication services I would interact with, but how about the simple case of a self-contained ASP.NET project that does not use any third-party authentication.  Does ASP.NET itself have any requirements?</p></li>
  </ol>
  
  <p>Any links to requirements and/or best practices regarding usage of specific key/values would be appreciated.</p>