How to refresh updated Claims without login out

[Alienroid]

I am using Blazor Server Side.

This document specified "SignInManager and UserManager aren't supported in Razor components."

I have a custom Claim (example FirstName) by following the documentation. I can read it with "user.Claims.FirstOrDefault(s => s.Type == "FirstName")?.Value". If I update this Claim. When I read this from Claim, it was getting the previously Claim (I believe it is not refreshed). How do I refresh this Claim without using SignInManager/UserManager:

var user = await _userManager.GetUserAsync(User);
await _signInManager.RefreshSignInAsync(user);

If I look at the database, the value is updated. If I logout and re-login, the value is updated.

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: f75d9405-19a5-a14b-3a09-a3605b240750
• Version Independent ID: 1247ee64-fbc9-ce29-0710-f6e59380f5ee
• Content: ASP.NET Core Blazor authentication and authorization
• Content Source: aspnetcore/blazor/security/index.md
• Product: aspnet-core
• Technology: aspnetcore-blazor
• GitHub Login: @guardrex
• Microsoft Alias: riande

[guardrex]

@HaoK ... Is the idea to inject a service into the component, the service has a method that uses UserManager/SignInManager (RefreshSignInAsync), and the user calls the service's method to accomplish a refresh of the user?

BTW and outside of the scope of this issue: Although we cover adding claims in Blazor WebAssembly, we don't discuss updating claims in Blazor WASM apps either. However, I'll eventually reach the Blazor Security & Identity node of topics on my UE passes. I hope to identity and iron out missing coverage, such as this scenario, at that time.

UPDATE: There are some 🐉 dragons 🐉 in these use cases. I took a look at a few engineering issues on the subject (e.g., dotnet/aspnetcore#22031 (comment), dotnet/aspnetcore#21199 (comment)). As I mentioned, I'd like to work further on these cases later when I reach this node on UE passes. For now Hao, is there anything that I can add to the NOTE that says ...

SignInManager<TUser> and UserManager<TUser> aren't supported in Razor components.

Cross-ref: https://docs.microsoft.com/aspnet/core/blazor/security/

... for Blazor Server?

WRT Hosted Blazor WASM, we demo a use case for hitting Identity controller endpoints that can use UserManager/SignInManager in the IdS topic. When I work this issue, I'll try a cross-link to it as an example, then circle around on UE passes to fix up proper coverage. Cross-ref: https://docs.microsoft.com/aspnet/core/blazor/security/webassembly/hosted-with-identity-server#usermanager-and-signinmanager

[Alienroid]

I am guessing here, but I think the reason for the note "SignInManager and UserManager aren't supported in Razor components." is probably due to developers trying to call UserManager (which has a scoped lifetime) multiple times within same page. If a page contains 2(or more) components that both use UserManager, the app will crash due to "invalidOperationException: A second operation started on this context before a previous operation completed. Any instance members are not guaranteed to be thread-safe."

Reference: dotnet/aspnetcore#18340 and https://stackoverflow.com/questions/59747983/blazor-concurrency-problem-using-entity-framework-core (read the answer part)

Where as recommendation for DbContext is to use a factory or set as Transient, UserManager is just Scoped and we cannot change it to Transient.

TLDR; I wonder if we can still use UserManager, just need to make a note that UserManager only works on page level and only one can be used within the page, else the app will crash.

[guardrex]

🐉 DRAGONS! 🐉 ... 😨🏃 ... 😄

@Alienroid ... Did you consider a controller endpoint approach via ordinary Identity (RP/MVC) that refreshes the user?

[Alienroid]

Some context and I am thinking about another work around.

I am trying to add an user profile page, able to view, edit by the user and view by other users. I have a navigation bar that contains user profile image and notification (with outstanding notification counter). I have the issue of using UserManager twice, once in the page and one in the navigationbar; hence, I removed the NavBar call to UserManager for now.

I extended IdentityUser to be AppUser with added properties like FirstName, LastName, etc
I extended UserManagerExtenstion to call "await userManager.UpdateAsync(user);" to update user
Whenever I need to access user data, I'll call "await userManager.GetUserAsync(cpUser);"

With the page recommending UserManager is not supported, I've changed userManager.GetUserAsync(cpUser); to getting that data from " (await authenticationStateTask).User;"'s claims like: "user.Claims.FirstOrDefault(s => s.Type == "FirstName")?.Value"

I may move UserManagerExtension code to a service so I can update user (haven't tried this). But once that is updated, if I call "user.Claims.FirstOrDefault(s => s.Type == "FirstName")?.Value", it's still using the old data until I logout. Hence this open request.

I am just thinking about a workaround. Perhaps, I should create an user object that gets populated (from "user.Claims.FirstOrDefault..." and pass it via cascadingParameter/Value for the entire duration of the lifetime. Rest of the app won't be reading directly from "await userManager.GetUserAsync(cpUser);", but just read this user object. Whenever user relogin, that's the only time this user object will be populated directly from "await userManager.GetUserAsync(cpUser);". The disadvantage is that if the user data is outside of the scope (say from another browser), the user properties will be out of sync (which may be acceptable).

[Alienroid]

🐉 DRAGONS! 🐉 ... 😨🏃 ... 😄

@Alienroid ... Did you consider a controller endpoint approach via ordinary Identity (RP/MVC) that refreshes the user?

No. Do you mean after I update UpdateAsync, I'll redirect to a controller page that does

var user = await _userManager.GetUserAsync(User);
await _signInManager.RefreshSignInAsync(user);

Then redirect back to the page?

That might work as well.

By the way, I don't get your emoticon. dragons ... shock... .run... laugh?

[HaoK]

Dragons are scary and randomly breathe fire, which is apt for trying to use User/SignInManager with blazor. Yeah it was designed with very specific usage requirements in mind, as all of these threads/issues seem to be demonstrating

[guardrex]

😨 == fear mostly ... I'm worried that its easy to get into trouble and compromise security with a lack of official Blazor guidance that doesn't answer enough basic questions. I prefer that we have trustworthy, complete guidance for basic scenarios so that devs don't trust non-MS poor guidance (e.g., things found in random blog posts) ... or even just guess wrong and compromise security or have buggy apps.

after I update UpdateAsync, I'll redirect to a controller page that does

Yes, exactly ... because the PU has said over and over (including those Javier posts) that the core Identity security approaches work for Blazor BUT ONLY via controller Identity endpoints.

Hello @HaoK ... I leave this for you to advise me further on ... if something can/should be added. However, I'll hit these topics soon enough on UE passes, so we can do something quick/temporary with that NOTE if you want to.

[HaoK]

I'm not really sure what we should do here, calling @blowdart for thoughts, identity is pretty old and getting things to work outside of the controlled places like identity endpoints is definitely going to require some ninja skills...

My initial inclination would be to stick with the existing stance, where official advice is to only use identity inside of controllers, and everything else they are on their own.