public class EmployeeClaims
{
    [JsonPropertyName("givenName")]
    public string GivenName { get; set; } = string.Empty;
    [JsonPropertyName("surname")]
    public string Surname { get; set; } = string.Empty;
    [JsonPropertyName("mail")]
    public string Mail { get; set; } = string.Empty;
    [JsonPropertyName("jobTitle")]
    public string JobTitle { get; set; } = string.Empty;
    [JsonPropertyName("photo")] // "type": "image/jpg;base64url",
    public string Photo { get; set; } = string.Empty;
    [JsonPropertyName("displayName")]
    public string DisplayName { get; set; } = string.Empty;
    [JsonPropertyName("preferredLanguage")]
    public string PreferredLanguage { get; set; } = string.Empty;

    //[JsonPropertyName("userPrincipalName")]
    [JsonPropertyName("revocationId")]
    public string RevocationId { get; set; } = string.Empty;
}

public VerifierRequestPayload GetVerifierRequestPayload(HttpRequest request)
{
	var payload = new VerifierRequestPayload();

	var host = GetRequestHostName(request);
	payload.Callback.State = Guid.NewGuid().ToString();
	payload.Callback.Url = $"{host}/api/verifier/presentationCallback";
	payload.Callback.Headers.ApiKey = _credentialSettings.VcApiCallbackApiKey;

	payload.Registration.ClientName = "VerifiedEmployee";
	payload.Authority = _credentialSettings.VerifierAuthority;

	var requestedCredentials = new RequestedCredentials
	{
		CrendentialsType = "VerifiedEmployee",
		Purpose = "Verified Employee to authenticate your request"
	};
	requestedCredentials.AcceptedIssuers.Add(_credentialSettings.IssuerAuthority);
	payload.RequestedCredentials.Add(requestedCredentials);

	return payload;
}

[HttpGet("/api/verifier/presentation-request")]
public async Task<ActionResult> PresentationRequest()
{
	try
	{
		var payload = _verifierService.GetVerifierRequestPayload(Request);
		var (Token, Error, ErrorDescription) = await _verifierService.GetAccessToken();

		if (string.IsNullOrEmpty(Token))
		{
			_log.LogError("failed to acquire accesstoken: {Error} : {ErrorDescription}", Error, ErrorDescription);
			return BadRequest(new { error = Error, error_description = ErrorDescription });
		}

		var defaultRequestHeaders = _httpClient.DefaultRequestHeaders;
		defaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", Token);

		var res = await _httpClient.PostAsJsonAsync(
			_credentialSettings.Endpoint, payload);

		if (res.IsSuccessStatusCode)
		{
			var response = await res.Content.ReadFromJsonAsync<VerifierResponse>();
			response!.Id = payload.Callback.State;
			_log.LogTrace("succesfully called Request API");

			if (res.StatusCode == HttpStatusCode.Created)
			{
				var cacheData = new CacheData
				{
					Status = VerifierConst.NotScanned,
					Message = "Request ready, please scan with Authenticator",
					Expiry = response.Expiry.ToString(CultureInfo.InvariantCulture),
				};
				CacheData.AddToCache(payload.Callback.State, _distributedCache, cacheData);

				return Ok(response);
			}
		}
		else
		{
			var message = await res.Content.ReadAsStringAsync();

			_log.LogError("Unsuccesfully called Request API {message}", message);
			return BadRequest(new { error = "400", error_description = message });
		}

		var errorResponse = await res.Content.ReadAsStringAsync();
		_log.LogError("Unsuccesfully called Request API");
		return BadRequest(new { error = "400", error_description = "Something went wrong calling the API: " + errorResponse });
	}
	catch (Exception ex)
	{
		return BadRequest(new { error = "400", error_description = ex.Message });
	}
}

[HttpPost]
public async Task<ActionResult> PresentationCallback()
{
	var content = await new StreamReader(Request.Body).ReadToEndAsync();
	var verifierCallbackResponse = JsonSerializer.Deserialize<VerifierCallbackResponse>(content);

	try
	{
		if (verifierCallbackResponse != null  && verifierCallbackResponse
			.RequestStatus == VerifierConst.RequestRetrieved)
		{
			var cacheData = new CacheData
			{
				Status = VerifierConst.RequestRetrieved,
				Message = "QR Code is scanned. Waiting for validation...",
			};
			CacheData.AddToCache(verifierCallbackResponse.State, _distributedCache, cacheData);
		}

		if (verifierCallbackResponse != null && verifierCallbackResponse
			.RequestStatus == VerifierConst.PresentationVerified)
		{
			var cacheData = new CacheData
			{
				Status = VerifierConst.PresentationVerified,
				Message = "Presentation verified",
				Payload = JsonSerializer.Serialize(verifierCallbackResponse.VerifiedCredentialsData),
				Subject = verifierCallbackResponse.Subject
			};

			cacheData.Employee.Photo = verifierCallbackResponse
				.VerifiedCredentialsData!.FirstOrDefault()!.Claims.Photo;
			cacheData.Employee.RevocationId = verifierCallbackResponse
				.VerifiedCredentialsData!.FirstOrDefault()!.Claims.RevocationId;
			cacheData.Employee.PreferredLanguage = verifierCallbackResponse
				.VerifiedCredentialsData!.FirstOrDefault()!.Claims.PreferredLanguage;
			cacheData.Employee.Surname = verifierCallbackResponse
				.VerifiedCredentialsData!.FirstOrDefault()!.Claims.Surname;
			cacheData.Employee.GivenName = verifierCallbackResponse
				.VerifiedCredentialsData!.FirstOrDefault()!.Claims.GivenName;
			cacheData.Employee.DisplayName = verifierCallbackResponse
				.VerifiedCredentialsData!.FirstOrDefault()!.Claims.DisplayName;
			cacheData.Employee.Mail = verifierCallbackResponse
				.VerifiedCredentialsData!.FirstOrDefault()!.Claims.Mail;
			cacheData.Employee.JobTitle = verifierCallbackResponse
				.VerifiedCredentialsData!.FirstOrDefault()!.Claims.JobTitle;

			CacheData.AddToCache(verifierCallbackResponse.State, _distributedCache, cacheData);
		}

		return Ok();
	}
	catch (Exception ex)
	{
		return BadRequest(new { error = "400", error_description = ex.Message });
	}
}

<form method="post" id="verifyEmployeePaycheck" action="" novalidate>
    <input type="hidden" required id="statePresented" name="statePresented"/>
</form>

public async Task<IActionResult> OnPostAsync()
{
	if (StatePresented == null)
	{
		ModelState.AddModelError("StatePresented", "no vc");
		return Page();
	}

	var credentialData = CacheData.GetFromCache(StatePresented, _distributedCache);

	var claims = new List<Claim> {
		new Claim("DisplayName", credentialData!.Employee.DisplayName, 
			ClaimValueTypes.String, "damienbodsharepoint"),
		new Claim("JobTitle", credentialData!.Employee.JobTitle, 
			ClaimValueTypes.String, "damienbodsharepoint"),
		new Claim("PreferredLanguage", credentialData!.Employee.PreferredLanguage, 
			ClaimValueTypes.String, "damienbodsharepoint"),
		new Claim("RevocationId", credentialData!.Employee.RevocationId, 
			ClaimValueTypes.String, "damienbodsharepoint"),
		new Claim("GivenName", credentialData!.Employee.GivenName, 
			ClaimValueTypes.String, "damienbodsharepoint"),
		new Claim("Mail", credentialData!.Employee.Mail, 
			ClaimValueTypes.String, "damienbodsharepoint"),
		new Claim("Surname", credentialData!.Employee.Surname, 
			ClaimValueTypes.String, "damienbodsharepoint"),
		new Claim("Photo", credentialData!.Employee.Photo, 
			ClaimValueTypes.String, "damienbodsharepoint"),
	};

	var userIdentity = new ClaimsIdentity(claims, "entraemployee");
	var userPrincipal = new ClaimsPrincipal(userIdentity);

	await HttpContext.SignInAsync(
		CookieAuthenticationDefaults.AuthenticationScheme,
		userPrincipal,
		new AuthenticationProperties
		{
			ExpiresUtc = DateTime.UtcNow.AddMinutes(20),
			IsPersistent = false,
			AllowRefresh = false
		});

	CacheData.RemoveFromCache(StatePresented, _distributedCache);

	return Redirect($"~/Paycheck/PaycheckDetailsS3/{PaycheckId}");
}