How can I re-read claims?

[DavidThielen]

Is there any way to force the AuthenticationState to re-read the database when claims have changed?

I've implemented a ServerAuthenticationStateProvider and it works great for my adding IdentityUser.Enabled. But when I set it to re-read the claims on a call to ExAuthenticationStateProvider.GetAuthenticationStateAsync(), while that does return an updated list of the claims, that list is not propagated to the AuthenticationState .

Is there a way to propagate it other than having the user log out and back in?

I have the relevant code below. The problem is, when I call NotifyAuthenticationStateChanged() from when I call UpdateState() in my blazor page it throws:

InvalidOperationException - Collection was modified; enumeration operation may not execute.

With a call stack of:

at System.ThrowHelper.ThrowInvalidOperationException_InvalidOperation_EnumFailedVersion() in System\ThrowHelper.cs:line 432
   at System.Collections.Generic.List1.Enumerator.MoveNext() in System.Collections.Generic\List.cs:line 58
   at Microsoft.AspNetCore.Components.CascadingValueSource1.<>c__DisplayClass10_0.<NotifyChangedAsync>b__0() in Microsoft.AspNetCore.Components\CascadingValueSource.cs:line 73
   at Microsoft.AspNetCore.Components.Rendering.RendererSynchronizationContextDispatcher.InvokeAsync(Action workItem) in Microsoft.AspNetCore.Components.Rendering\RendererSynchronizationContextDispatcher.cs:line 29
   at Microsoft.AspNetCore.Components.CascadingValueSource1.NotifyChangedAsync() in Microsoft.AspNetCore.Components\CascadingValueSource.cs:line 71
   at Microsoft.AspNetCore.Components.CascadingValueSource1.NotifyChangedAsync(TValue newValue) in Microsoft.AspNetCore.Components\CascadingValueSource.cs:line 88
   at Microsoft.Extensions.DependencyInjection.CascadingAuthenticationStateServiceCollectionExtensions.AuthenticationStateCascadingValueSource.HandleAuthenticationStateChanged(Task1 newAuthStateTask)
   at LouisHowe.web.Services.ExAuthenticationStateProvider.ResetNextCheck() in C:\Git\LouisHowe\LouisHowe.web\Services\ExAuthenticationStateProvider.cs:line 46
   at LouisHowe.web.Pages.Admin.ListClaims.<OnDataItemDeleting>d__46.MoveNext() in C:\Git\LouisHowe\LouisHowe.web\Pages\Admin\ListClaims.razor.cs:line 439
   at LouisHowe.web.Pages.Admin.ListClaims.<OnDataItemDeleting>d__46.MoveNext() in C:\Git\LouisHowe\LouisHowe.web\Pages\Admin\ListClaims.razor.cs:line 443

Any idea how to work around this? I think that the notification needs to be called to update the cascading value. But it doesn't like it being updated here.

??? - thanks - dave

In Main()

builder.Services.AddCascadingAuthenticationState();
builder.Services.AddAuthorization();
builder.Services.AddScoped<AuthenticationStateProvider, ExAuthenticationStateProvider>();

Routes.razor:

<Router AppAssembly="typeof(Program).Assembly">
    <Found Context="routeData">
        <AuthorizeRouteView RouteData="@routeData" DefaultLayout="@typeof(MainLayout)">
            <NotAuthorized>
                <div class="message--401">
                    <h1 role="alert">Sorry, you're not authorized to view this page.</h1>
                    <p>You must have an Admin claim and be set to use 2FA when logging in.</p>
                </div>
            </NotAuthorized>
        </AuthorizeRouteView>
        <FocusOnNavigate RouteData="@routeData" Selector="h1" />
    </Found>
    <NotFound>
        <PageTitle>Not found</PageTitle>
        <LayoutView Layout="@typeof(MainLayout)">
            <div class="message--404">
                <h1 role="alert">Sorry, there's nothing at this address.</h1>
            </div>
        </LayoutView>
    </NotFound>

ExAuthenticationStateProvider.cs

    public class ExAuthenticationStateProvider : ServerAuthenticationStateProvider
    {

        // in UTC - when to do the next check (this time or later)
        private DateTime _nextCheck = DateTime.MinValue;

        private readonly TimeSpan _checkInterval = TimeSpan.FromMinutes(30);

        private readonly UserManager<ExIdentityUser> _userManager;

        private ILogger<ExAuthenticationStateProvider> Logger { get; set; }

		public ExAuthenticationStateProvider(UserManager<ExIdentityUser> userManager, IConfiguration config, ILogger<ExAuthenticationStateProvider> logger)
        {
            _userManager = userManager;
            Logger = logger;
            var minutes = config.GetSection("Identity:RevalidateMinutes").Value;
            if (!string.IsNullOrEmpty(minutes) && int.TryParse(minutes, out var intMinutes)) 
	            _checkInterval = TimeSpan.FromMinutes(intMinutes);
        }

        /// <summary>
        /// Revalidate the next time GetAuthenticationStateAsync() is called.
        /// </summary>
        public void ResetNextCheck()
        {
			_nextCheck = DateTime.MinValue;
			// announce the change - THROWS AN EXCEPTION
			base.NotifyAuthenticationStateChanged(GetAuthenticationStateAsync());
		}

		/// <inheritdoc />
		public override async Task<AuthenticationState> GetAuthenticationStateAsync()
        {

	        try
	        {
		        if (Logger.IsEnabled(LogLevel.Trace))
			        Logger.LogTrace("entering GetAuthenticationStateAsync()");

		        // if less than 30 minutes since last check, then just return the default
		        var now = DateTime.UtcNow;
		        if (now < _nextCheck)
			        return await base.GetAuthenticationStateAsync();
		        _nextCheck = now + _checkInterval;

		        // if we're not authenticated, then just return the default
		        var authState = await base.GetAuthenticationStateAsync();
		        if (authState.User.Identity == null)
		        {
			        Trap.Break();
			        return new AuthenticationState(new ClaimsPrincipal(new ClaimsIdentity()));
		        }

		        // they're not authenticated so return what we have.
		        if ((!authState.User.Identity.IsAuthenticated) || string.IsNullOrEmpty(authState.User.Identity.Name))
			        return new AuthenticationState(new ClaimsPrincipal(authState.User.Identity));

		        // if the user is not in the database, then just return the default
		        var id = authState.User.UserId();
		        var user = id == null ? null : await _userManager.FindByIdAsync(id);
		        if (user == null)
			        return new AuthenticationState(new ClaimsPrincipal(authState.User.Identity));

		        // disabled - so anonymous user (system doesn't have the concept of disabled users)
		        if (!user.Enabled)
		        {
			        var anonymousUser = new ClaimsPrincipal(new ClaimsIdentity());
			        return new AuthenticationState(anonymousUser);
		        }

		        // update to the latest claims - only if changed (don't want to call NotifyAuthenticationStateChanged() if nothing changed)
		        var listDatabaseClaims = (await _userManager.GetClaimsAsync(user)).ToList();
		        var listExistingClaims = authState.User.Claims
			        .Where(claim => AuthorizeRules.AllClaimTypes.Contains(claim.Type)).ToList();

		        bool claimsChanged;
		        if (listExistingClaims.Count != listDatabaseClaims.Count)
			        claimsChanged = true;
		        else
			        claimsChanged = listExistingClaims.Any(claim => listDatabaseClaims.All(c => c.Type != claim.Type));

		        if (!claimsChanged)
			        return authState;

		        // existing identity, but with new claims
		        // the ToList() is to make a copy of the claims so we can read the existing ones and then remove from claimsIdentity
		        var claimsIdentity = new ClaimsIdentity(authState.User.Identity);
		        foreach (var claim in claimsIdentity.Claims.ToList()
			                 .Where(claim => AuthorizeRules.AllClaimTypes.Contains(claim.Type)))
			        claimsIdentity.RemoveClaim(claim);
		        claimsIdentity.AddClaims(listDatabaseClaims);

		        // set this as the authentication state
		        var claimsPrincipal = new ClaimsPrincipal(claimsIdentity);
		        authState = new AuthenticationState(claimsPrincipal);
		        SetAuthenticationState(Task.FromResult(authState));

		        // return the existing or updates state
		        return authState;
	        } finally
	        {
		        if (Logger.IsEnabled(LogLevel.Trace))
			        Logger.LogTrace("leaving GetAuthenticationStateAsync()");
			}
		}
    }