SignInWithClaims drops additional claims after some time

[marcuslindblom]

I’m using _signInManager.SignInWithClaimsAsync and that works fine and so but the additional claims are dropped after a while. Why is that happening?

The user is still logged in but the additional claims I added at sign in is gone?

[Tratcher]

@blowdart @HaoK

[blowdart]

I’m using _signInManager.SignInWithClaimsAsync and that works fine and so but the additional claims are dropped after a while. Why is that happening?

Define "a while". 15-20 minutes perhaps?

[marcuslindblom]

@blowdart Yes that seems to be correct.

[blowdart]

ASP.NET Identity has a refresh period. After a certain time it runs off back to the database and refreshs the identity, rewriting it to the cookie, just in case names, emails, claims etc. have changed. As you're adding extra claims it doesn't know about during sign-in those get dropped. It also is responsible for logging out other sessions should something critical have changed.

This code lives in the security stamp validator. From there you can hopefully see a handy little event, hidden in options for that class, Options.OnRefreshingPrincipal(replaceContext). You're going to need to add your extra claims appending code in there as well.

[marcuslindblom]

Ok, thanks for a good explanation 🙏

I’ll take a look and see if I can make it work

[marcuslindblom]

I guess something like this would do the trick?

      services.Configure<SecurityStampValidatorOptions>(options => {
        options.OnRefreshingPrincipal = context => {
          var identity = new ClaimsIdentity();
          identity.AddClaim(context.CurrentPrincipal.FindFirst(ClaimType.Workspace));
          identity.AddClaim(context.CurrentPrincipal.FindFirst(ClaimType.WorkspaceId));
          context.NewPrincipal.AddIdentity(identity);
          return Task.FromResult(0);
        };
      });

[blowdart]

Assuming those claims are there,then I would think so.