1

I am using scheme with authentication using my DB and ASP Core identity Server. I also implemented IResourceOwnerPasswordValidator and IProfileService. I am connecting to server through tokenClient.RequestResourceOwnerPasswordAsync method and dont use MVC

Everything seems working as expected, but I want to set IsLoggedIn property to my user and save it in DB and when session will be over, set it to false.

What is the best place to do it? Didn't find answer anywhere.

EDIT

Additionally I want to mention that i use IdentityModel client lib to connect to IdentityServer, so I have no rest api in my case

2
  • This seems a simple question but is rather broad. When is in your definition a user logged in? And what session are you refering to? Are you using IdentityServer4 with JWT tokens or reference tokens?
    – user4864425
    Oct 6, 2018 at 14:39
  • @RuardvanElburg I think user is logged in, when all auth procedures committed successfully, but I don`t know how to catch that moment exactly. That is my question about. Actually I want to have only one sign in session per user and not allow to have multiple signins until user is sign out explicitly or by timeout.
    – Denis
    Oct 6, 2018 at 16:11

1 Answer 1

1

Whenever a token is requested, the Token Endpoint is called. You can use the ProfileService to hook into the flow. You can add your own version:

public class ProfileService : IProfileService
{
    public async Task GetProfileDataAsync(ProfileDataRequestContext context)
    {
        var sub = context.Subject.GetSubjectId();
        var user = await _userManager.FindByIdAsync(sub);
        var principal = await _claimsFactory.CreateAsync(user);

        var claims = principal.Claims.Where(claim => context.RequestedClaimTypes.Contains(claim.Type)).ToList();

        // Add your code ...

        context.IssuedClaims = claims;
    }

    public async Task IsActiveAsync(IsActiveContext context)
    {
        var sub = context.Subject.GetSubjectId();
        var user = await _userManager.FindByIdAsync(sub);
        context.IsActive = user != null;
    }
}

Please note the context.Caller. This indicates the used endpoint. For an access token and refresh token this should be ProfileDataCallers.ClaimsProviderAccessToken.

Don't forget to register the service:

services.AddIdentityServer()
    ...
    .AddProfileService<ProfileService>();

But the Token endpoint isn't called always. In case you login to IdentityServer directly, you'll need to add code to the login method. When you are using the sample projects of IdentityServer then you'll have an AccountController in the IdentityServer project. Add your code in the login method after this line:

await HttpContext.SignInAsync(user.Id, user.UserName, props);

In the same way you can change the status in the logout method.


This only confirms when a user needs a new access token, but not if the user is actually logged in after that. Most users probably never logout and most likely the cookie will be destroyed or simply expires.

So you may want to consider to set the access token to a short lifetime, like 5 minutes and consider a user logged out after 5 minutes. As the access token is expired, the user needs to login again (or refresh the access token).


You can limit refresh tokens to one time use only. You can also consider to use Reference tokens instead:

When using reference tokens - IdentityServer will store the contents of the token in a data store and will only issue a unique identifier for this token back to the client.

If I'm not mistaken you can limit this to one active token.

2

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.