Identityserver4.admin: Refresh Token after User Changes Role

[houssam-saissi]

Hi,
First, thank you for this great job I appreciate it a lot :) . My question is :
The user remains logged in and accesses AdminUI when I delete the Role, How to block access or redirect to an error page?
Thank you :)

[skoruba]

Hi @houssam-saissi
It's great question.

You can use your implementation of method - ValidatePrincipal and check information about user/roles from cookie like this:
https://docs.microsoft.com/en-us/aspnet/core/security/authentication/cookie?view=aspnetcore-2.1&tabs=aspnetcore2x#react-to-back-end-changes

If user has invalid role for administration you can reject access:

context.RejectPrincipal();
await context.HttpContext.SignOutAsync(CookieAuthenticationDefaults.AuthenticationScheme);

I hope it will help for your scenario. :)
Thanks!

[houssam-saissi]

Hi @skoruba ,

Hum i see ^_^ thanks for the solution. However, i am confused between claims and permissions uses. i want to use identiyserver for access limit operations data. For example : grant user CRUD or denied it without logged out. It is rather how to use a combination between Identityserver and Aspnet.Identity.

Thank you :)

[skoruba]

Hi @houssam-saissi
can you please describe specific situation? :) I need more context.
Thanks!

[skoruba]

Any update? - @houssam-saissi :)

[houssam-saissi]

Hello @skoruba,
Yes, on StartupHelpers.cs, I changed:
context.Properties.ExpiresUtc = new DateTimeOffset (DateTime.Now.AddHours (1)); and the token refreshes every hour so all permissions and roles are up to date ^_^