用户声明更新未在 ASP.NET 身份中生效？

Question

我需要在用户登录后更新 Web api 中的用户声明。但在更新用户声明后，它仍将 return 以前的值。以下代码用于在用户登录后更新活动用户组。

/// <summary>
/// The class AppUser
/// </summary>
public class AppUser : ClaimsPrincipal
{
    /// <summary>
    /// Initializes a new instance of the <see cref="AppUser"/> class.
    /// </summary>
    /// <param name="principal">The principal.</param>
    public AppUser(ClaimsPrincipal principal)
        : base(principal)
    {
    }

    /// <summary>
    /// Gets the name.
    /// </summary>
    /// <value>
    /// The name.
    /// </value>
    public string Name
    {
        get
        {
            return this.FindFirst(ClaimTypes.Name).Value;
        }
    }

    /// <summary>
    /// Gets the name of the user.
    /// </summary>
    /// <value>
    /// The name of the user.
    /// </value>
    public string UserName
    {
        get
        {
            return this.FindFirst("UserName").Value;
        }
    }

    /// <summary>
    /// Gets the active group.
    /// </summary>
    /// <value>
    /// The active group.
    /// </value>
    public string ActiveGroup
    {
        get
        {
            return ((ClaimsIdentity)this.Identity).FindFirst("ActiveGroup").Value;
        }
    }

    /// <summary>
    /// Gets the email.
    /// </summary>
    /// <value>
    /// The email.
    /// </value>
    public string Email
    {
        get
        {
            return this.FindFirst("Email").Value;
        }
    }
}


/// <summary>
/// The class BaseController
/// </summary>
public class BaseController : ApiController
{
    /// <summary>
    /// Gets the current user.
    /// </summary>
    /// <value>
    /// The current user.
    /// </value>
    public AppUser CurrentUser
    {
        get
        {
            return new AppUser(this.User as ClaimsPrincipal);
        }
    }
}



public class AccountController : BaseController
{

    [HttpPost]
    [Route("UpdateUserGroup")]
    public int UpdateUserGroup(string userGroup)
    {
        var user = User as ClaimsPrincipal;
        var identity = user.Identity as ClaimsIdentity;
        identity.RemoveClaim(identity.FindFirst("ActiveGroup"));
        identity.AddClaim(new Claim("ActiveGroup", this.GetRoleNameByPresenter(userGroup)));
        return 1;
    }
 }

Answer 1

问题在于声明在身份验证过程中使用并且是身份验证的一部分 token/cookie。如果您想删除当前用户的声明，则需要确保客户端获得新的 token/cookie.

如果您运行例如使用 api 的不记名令牌，那么您需要生成一个新令牌，然后 return 从您的 UpdateUserGroup() 向客户端发送该令牌。然后，客户端在下次向 api.

发出请求时需要使用新令牌

用户声明更新未在 ASP.NET 身份中生效？

User claim update not effected in ASP.NET Identity?

identity

claims

asp.net-web-api