Geek Answers Handbook

OnValidateIdentity disables the MVV OWIN function

When I activate the OWIN function to log out using security tokens and use the OnValidateIdentity -Callback CookieAuthenticationProvider with the SecurityStampValidator class, the user logs out every time he closes the browser.

 provider.OnValidateIdentity = SecurityStampValidator.OnValidateIdentity<MyUserManager, MyUser>( System.TimeSpan.FromSeconds(10),(manager, user) => { return user.GenerateUserIdentityAsync(manager); });

However, when I do the plumbing myself (searching and comparing security stamps, refusal or updating an identifier) ​​in the OnValidateIdentity callback, everything seems to work fine.

Is this a known bug or am I missing something? Or is there some good documentation about CookieAuthenticationProvider and using OnValidateIdentity ?
Digging in google shows only some simple patterns, but does not provide further understanding.

Additional Information

  • I use my own implementation of UserStorage, which saves all the data in the database
  • I noted that each page request calls GetSecurityStampAsync UserStorage twice, if I use my implementation only one call is made.
  • Installed Identity Version 2.0.1
+2
source share
3 answers

This is allowed in ASP.NET Identity 2.2. See https://aspnetidentity.codeplex.com/workitem/2319

+3
source

This is mainly a mistake; cookie regeneration should take into account the current option Remember me in cookie. As a workaround, you can copy the OnValidateIdentity code and feed into the current context properties in order to pass persistent mode with:

 context.OwinContext.Authentication.SignIn(context.Properties, identity);
+4
source

I found the following code when parsing SecurityStampValidator.OnValidateIdentity :

 // .. some other code // ... ClaimsIdentity claimsIdentity = await regenerateIdentityCallback(userManager, tUser); if (claimsIdentity != null){ context.get_OwinContext().get_Authentication().SignIn(new ClaimsIdentity[] { claimsIdentity }); }

It seems to me that the SignIn operation is incomplete and should set the Remember-me option? Therefore, I assume that the implementation of SecurityStampValidator is erroneous.

0
source

More articles:


All Articles