[2026.3.3] $ClaimsPrincipal is a JSON string

Backlog

[2026.3.3] $ClaimsPrincipal is a JSON string

avatar
SunnyJ

PSU 2026.3.3

IIS Hosted

Endpoint/API

$ClaimsPrincipal looks to be a json string instead of the [ClaimPrincipal] class as indicated in the documentation here: Variables | Devolutions PowerShell Universal | Product guides & reference.

Attempting to filter under the assumption that it's the .Net class fails:

$ClaimsPrincipal.Claims | ?{ $_.Issuer -eq 'https://www.poshtools.com' } | ?{ @('MyApproved','GroupsHere') -contains $_.Value })

Instead, I have to convert it from JSON to then be able to filter:

($ClaimsPrincipal | ConvertFrom-Json).Claims | ?{ $_.Issuer -eq 'https://www.poshtools.com' } | ?{ @('MyApproved','GroupsHere') -contains $_.Value }

Is this intentional or a bug? If it's intentional, the documentation should probably be updated.

All Comments (2)

avatar
Patrick Ouimet

Hello SunnyJ,

Thank you for the clear report and for sharing the workaround.

Your observation is correct.

In an API endpoint, $ClaimsPrincipal arrives as a serialized JSON string, not as a live ClaimsPrincipal object.

That is why $ClaimsPrincipal.Claims returns nothing until you run ConvertFrom-Json.

The Variables page lists the type as ClaimPrincipal, so the documentation does not match what you see in endpoints.

I will confirm with our product team whether this is the intended design.

I will also ask for the documentation to be corrected.

Until then, your ConvertFrom-Json approach is the right one.

If you only need the caller name, the $Identity variable returns it as a string.

I will update this thread once I hear back.

Best regards,

Patrick Ouimet

avatar
Patrick Ouimet

Hello SunnyJ,

Thank you again for your patience.

The PowerShell Universal team confirmed that $ClaimsPrincipal arriving as a JSON string in API endpoints is not intentional.

We reproduced it on 2026.3.3 and on earlier builds.

A bug has been filed with the development team (ticket PSU-1490, for internal reference only).

I do not have a fix version yet.

Until then, your ConvertFrom-Json approach is the right workaround.

If you only need the caller name, the $Identity variable returns it as a string.

I will update this thread as soon as there is news on the fix.

Best regards,

Patrick Ouimet