Clash Royale CLAN TAG#URR8PPP

User Signed Out of IdentityServer4 after calling HttpContext.SignInAsync

Following on from this question, I have an interesting dilemma.

I've built out my IdentityServer based on the IdentityServer4 Quickstarts. When the Client directs the user to the IdentityServer, and the user authenticates, the AccountController on IdentityServer does a _signInManager.PasswordSignInAsync, and the user is signed in to IdentityServer.

AccountController

_signInManager.PasswordSignInAsync

This can be confirmed by opening another browser tab and navigating to the IdentityServer root URL, and sure enough, the logged-in user name shows on the top right corner, as expected.

As explained in my question linked above, the user is then directed to a page from which they need to select the Tenant they wish to work on, before being redirected back to the Client app (that interaction works).

However, following the selection of a Tenant, the TenantController then calls HttpContext.SignInAsync([the currently logged-in user's subject claim value], [the selected tenant claim]), with the intention that this re-signs-in the already-signed-in user, passing the additional Tenant Claim. (This is my attempt to get the selected TenantId claim to appear in the token sent back to the Client...and I'm open to suggestions about a better way to do this.)

HttpContext.SignInAsync([the currently logged-in user's subject claim value], [the selected tenant claim])

And although the completion of this interaction does indeed pass back the expected user information in the token sent to the Client, it effectively signs the user out of IdentityServer?!? A refresh of the identity server root url in the other tab shows that no user is signed in anymore.

Why is this? What am I doing wrong? I need the user to remain signed in to the identity server as he/she was before selecting a Tenant.

1 Answer
1

I replaced the use of the IdentityServer4-provided extension of HttpContext.SignInAsync with the standard built-in (to Microsoft.AspNetCore.Authentication) HttpContext.SignInAsync.

HttpContext.SignInAsync

HttpContext.SignInAsync

So instead of:

public static async Task SignInAsync(this HttpContext context, string subject, params Claim claims)

public static async Task SignInAsync(this HttpContext context, string subject, params Claim claims)

from IdentitySever4, I used

public static Task SignInAsync(this HttpContext context, string scheme, ClaimsPrincipal principal, AuthenticationProperties properties)

public static Task SignInAsync(this HttpContext context, string scheme, ClaimsPrincipal principal, AuthenticationProperties properties)

from Microsoft.AspNetCore.Authentication.

And in order to call it I built up the Principal as follows:

var userId = User.Claims.Single(r => r.Type == "sub").Value;
var user = await _userManager.FindByIdAsync(userId);
var principal = await _claimsFactory.CreateAsync(user);
((ClaimsIdentity)principal.Identity).AddClaim(new Claim("TenantId", tenant.Id.ToString()));


By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.