Can I force AuthenticationState to refresh (when claims have changed)?

David Thielen 3,116

Hi all;

Is there any way to force the AuthenticationState to re-read the database when claims have changed?

I've implemented a ServerAuthenticationStateProvider and it works great for my adding IdentityUser.Enabled. But when I set it to re-read the claims on a call to ExAuthenticationStateProvider.GetAuthenticationStateAsync(), while that does return and updated list of the claims, that list is not propagated to the AuthenticationState .

Is there a way to propigate it other than having the user log out and back in?

My Routes.razor is:

<Router AppAssembly="typeof(Program).Assembly">
    <Found Context="routeData">
        <AuthorizeRouteView RouteData="@routeData" DefaultLayout="@typeof(MainLayout)">
            <NotAuthorized>
                <div class="message--401">
                    <h1 role="alert">Sorry, you're not authorized to view this page.</h1>
                    <p>You must have an Admin claim and be set to use 2FA when logging in.</p>
                </div>
            </NotAuthorized>
        </AuthorizeRouteView>
        <FocusOnNavigate RouteData="@routeData" Selector="h1" />
    </Found>
    <NotFound>
        <PageTitle>Not found</PageTitle>
        <LayoutView Layout="@typeof(MainLayout)">
            <div class="message--404">
                <h1 role="alert">Sorry, there's nothing at this address.</h1>
            </div>
        </LayoutView>
    </NotFound>

thanks - dave

JasonPan - MSFT 5,466 Reputation points Microsoft Vendor

2024-04-12T02:47:24.0233333+00:00

Hi @David Thielen,

Could you share the method GetAuthenticationStateAsync in your ServerAuthenticationStateProvider ?

Best Regards

Jason

David Thielen 3,116

@JasonPan - MSFT Here you go - thanks

   public class ExAuthenticationStateProvider : ServerAuthenticationStateProvider
   {

       // in UTC - when to do the next check (this time or later)
       private DateTime _nextCheck = DateTime.MinValue;

       private readonly TimeSpan _checkInterval = TimeSpan.FromMinutes(30);

       private readonly UserManager<ExIdentityUser> _userManager;

       public ExAuthenticationStateProvider(UserManager<ExIdentityUser> userManager, IConfiguration config)
       {
           _userManager = userManager;
           var minutes = config.GetSection("Identity:RevalidateMinutes").Value;
           if (!string.IsNullOrEmpty(minutes) && int.TryParse(minutes, out var intMinutes)) 
            _checkInterval = TimeSpan.FromMinutes(intMinutes);
       }

       /// <summary>
       /// Revalidate the next time GetAuthenticationStateAsync() is called.
       /// </summary>
       public void ResetNextCheck()
       {
		_nextCheck = DateTime.MinValue;
	}

       /// <inheritdoc />
       public override async Task<AuthenticationState> GetAuthenticationStateAsync()
       {

           // if less than 30 minutes since last check, then just return the default
           var now = DateTime.UtcNow;
           if (now < _nextCheck)
               return await base.GetAuthenticationStateAsync();
           _nextCheck = now + _checkInterval;

           // if we're not authenticated, then just return the default
           var authState = await base.GetAuthenticationStateAsync();
           if (authState.User.Identity == null)
           {
               Trap.Break();
               return new AuthenticationState(new ClaimsPrincipal(new ClaimsIdentity()));
           }

           // they're not authenticated so return what we have.
           if ((!authState.User.Identity.IsAuthenticated) || string.IsNullOrEmpty(authState.User.Identity.Name))
               return new AuthenticationState(new ClaimsPrincipal(authState.User.Identity));

           // if the user is not in the database, then just return the default
           var id = authState.User.UserId();
		var user = id == null ? null : await _userManager.FindByIdAsync(id);
           if (user == null)
               return new AuthenticationState(new ClaimsPrincipal(authState.User.Identity));

           // disabled - so anonymous user (system doesn't have the concept of disabled users)
           if (!user.Enabled)
           {
               var anonymousUser = new ClaimsPrincipal(new ClaimsIdentity());
               return new AuthenticationState(anonymousUser);
           }

           // update to the latest claims - only if changed (don't want to call NotifyAuthenticationStateChanged() if nothing changed)
           var listDatabaseClaims = (await _userManager.GetClaimsAsync(user)).ToList();
           var listExistingClaims = authState.User.Claims.Where(claim => AuthorizeRules.AllClaimTypes.Contains(claim.Type)).ToList();

           bool claimsChanged;
           if (listExistingClaims.Count != listDatabaseClaims.Count)
            claimsChanged = true;
           else
            claimsChanged = listExistingClaims.Any(claim => listDatabaseClaims.All(c => c.Type != claim.Type));

           if (!claimsChanged)
               return authState;

           // existing identity, but with new claims
           // the ToList() is to make a copy of the claims so we can read the existing ones and then remove from claimsIdentity
           var claimsIdentity = new ClaimsIdentity(authState.User.Identity);
           foreach (var claim in claimsIdentity.Claims.ToList().Where(claim => AuthorizeRules.AllClaimTypes.Contains(claim.Type)))
            claimsIdentity.RemoveClaim(claim);
           claimsIdentity.AddClaims(listDatabaseClaims);

           // set this as the authentication state
           var claimsPrincipal = new ClaimsPrincipal(claimsIdentity);
           authState = new AuthenticationState(claimsPrincipal);
           SetAuthenticationState(Task.FromResult(authState));

           // return the existing or updates state
           return authState;
       }
   }

JasonPan - MSFT 5,466 Reputation points Microsoft Vendor

2024-04-12T08:45:11.7966667+00:00

Hi @David Thielen,

Could you kindly append this line NotifyAuthenticationStateChanged(Task.FromResult(authState));, after SetAuthenticationState(Task.FromResult(authState));?

Please let me know the test result, thanks for your patience.

Best Regards

Jason
David Thielen 3,116 Reputation points

2024-04-12T16:51:22.0266667+00:00

@JasonPan - MSFT Good idea but unfortunately no. The problem seem to be that GetAuthenticationStateAsync() is reading and returning the updated list of claims. But they are not getting to the cascaded Task<AuthenticationState>. Is there something I need to do on that to update that cascaded parameter?

thanks - dave

1 answer

Bruce (SqlWork.com) 65,131 Reputation points

2024-04-13T01:33:52.0766667+00:00

GetAuthenticationStateAsync() is only called once to get the state for cascade. You calling it again will not effect the cascade value. You use NotifyAuthenticationStateChanged(newAuthState) to notify state change listeners of a state change.

You should add a Reload method to your provider (called from a timer, of whatever triggers a state reload) this should call NotifyAuthenticationStateChanged(newAuthState) if it wants to cascade the update.
Please sign in to rate this answer.
David Thielen 3,116 Reputation points

2024-04-13T12:48:38.9133333+00:00

@Bruce (SqlWork.com) The only calling it once makes sense and explains the issue.

However, I am calling NotifyAuthenticationStateChanged(Task.FromResult(authState)); and that does not update the cascading parameter. Does it need to register something to receive that event?

thanks - dave

Bruce (SqlWork.com) 65,131 Reputation points

2024-04-15T17:10:46.2866667+00:00

it should already be plumbed. you need to call on the injected Authentication State Provider. also if you just want to use a timer try the RevalidatingIdentityAuthenticationStateProvider.

David Thielen 3,116 Reputation points

2024-04-15T17:14:46.1566667+00:00

@Bruce (SqlWork.com) How do I call the injected Authentication State Provider and what method do I call on it?

thanks - dave

Bruce (SqlWork.com) 65,131 Reputation points

2024-04-15T23:09:33.59+00:00

depends on where you are calling from. in my test sample. I added to StateProvider:

// add a claim to state public void UpdateState() { ++counter; _state.User.AddIdentity(new ClaimsIdentity(new List<Claim>() { new Claim($"test{counter}", $"test{counter}") })); base.NotifyAuthenticationStateChanged(Task.FromResult(_state)); }

changed index page to display state. add button to add claim

@page "/" @using Microsoft.AspNetCore.Identity @using System.Security.Claims @inject AuthenticationStateProvider authenticationStateProvider <PageTitle>Index</PageTitle> <h1>Hello, world!</h1> Welcome to your new app. <AuthorizeView> <Authorized> <table> <tr><th>Name</th><th>Value</th></tr> @foreach (var claim in context.User.Claims) { <tr> <td>@claim.Type</td> <td>@claim.Value</td> </tr> } </table> <button type="button" @onclick="addClaim">Add Claim</button> </Authorized> </AuthorizeView> @code { void addClaim() { ((dynamic) authenticationStateProvider).UpdateState(); } }

as all your code is in "GetAuthenticationStateAsync()" you could just add a method to your state provider:

public void UpdateState() { base.NotifyAuthenticationStateChanged(GetAuthenticationStateAsync()); }

David Thielen 3,116 Reputation points

2024-04-21T17:32:59.5866667+00:00

Calling NotifyAuthenticationStateChanged() when I call UpdateState() in my blazor page throws:

InvalidOperationException - Collection was modified; enumeration operation may not execute.

at System.ThrowHelper.ThrowInvalidOperationException_InvalidOperation_EnumFailedVersion() in System\ThrowHelper.cs:line 432 at System.Collections.Generic.List`1.Enumerator.MoveNext() in System.Collections.Generic\List.cs:line 58 at Microsoft.AspNetCore.Components.CascadingValueSource`1.<>c__DisplayClass10_0.<NotifyChangedAsync>b__0() in Microsoft.AspNetCore.Components\CascadingValueSource.cs:line 73 at Microsoft.AspNetCore.Components.Rendering.RendererSynchronizationContextDispatcher.InvokeAsync(Action workItem) in Microsoft.AspNetCore.Components.Rendering\RendererSynchronizationContextDispatcher.cs:line 29 at Microsoft.AspNetCore.Components.CascadingValueSource`1.NotifyChangedAsync() in Microsoft.AspNetCore.Components\CascadingValueSource.cs:line 71 at Microsoft.AspNetCore.Components.CascadingValueSource`1.NotifyChangedAsync(TValue newValue) in Microsoft.AspNetCore.Components\CascadingValueSource.cs:line 88 at Microsoft.Extensions.DependencyInjection.CascadingAuthenticationStateServiceCollectionExtensions.AuthenticationStateCascadingValueSource.HandleAuthenticationStateChanged(Task`1 newAuthStateTask) at LouisHowe.web.Services.ExAuthenticationStateProvider.ResetNextCheck() in C:\Git\LouisHowe\LouisHowe.web\Services\ExAuthenticationStateProvider.cs:line 46 at LouisHowe.web.Pages.Admin.ListClaims.<OnDataItemDeleting>d__46.MoveNext() in C:\Git\LouisHowe\LouisHowe.web\Pages\Admin\ListClaims.razor.cs:line 439 at LouisHowe.web.Pages.Admin.ListClaims.<OnDataItemDeleting>d__46.MoveNext() in C:\Git\LouisHowe\LouisHowe.web\Pages\Admin\ListClaims.razor.cs:line 443

Any idea how to work around this? I think you're right that the notification needs to be called to update the cascading value. But it doesn't like it being updated here.

??? - thanks - dave

Bruce (SqlWork.com) 65,131 Reputation points

2024-04-21T22:54:17.6966667+00:00

The error is caused when you are using a foreach on a collection, but update the collection inside the foreach. So it’s a bug in your code unrelated to the notify.

David Thielen 3,116 Reputation points

2024-04-21T23:45:16.42+00:00

I'm 99% sure that is not the case - in my code. I think it is happening inside the CascadingAuthenticationStateServiceCollectionExtensions.AuthenticationStateCascadingValueSource.HandleAuthenticationStateChanged() method. But that's ASP.NET code.

Any idea how I can call the following so it doesn't hit that error:

public void ResetNextCheck() { _nextCheck = DateTime.MinValue; base.NotifyAuthenticationStateChanged(GetAuthenticationStateAsync()); }

Bruce (SqlWork.com) 65,131 Reputation points

2024-04-30T16:08:51.5533333+00:00

then you are probably trying to update state during a change state event. do not change state during render. only on events.

David Thielen 3,116 Reputation points

2024-04-30T16:11:19.1166667+00:00

@Bruce (SqlWork.com) I am calling this in my event handler for the user clicking a SAVE button on a page. So this is throwing the exception when called from an event handler.

Bruce (SqlWork.com) 65,131 Reputation points

2024-04-30T19:49:12.7+00:00

I'd break on the error, and see which list is causing the error.

David Thielen 3,116 Reputation points

2024-04-30T20:05:13.2966667+00:00

@Bruce (SqlWork.com) It's in:

at Microsoft.AspNetCore.Components.CascadingValueSource`1.<>c__DisplayClass10_0.<NotifyChangedAsync>b__0() in Microsoft.AspNetCore.Components\CascadingValueSource.cs:line 73

How do I debug that - it's not my code.

??? - thanks - dave

Bruce (SqlWork.com) 65,131 Reputation points

2024-04-30T21:14:35.82+00:00

in the call stack window, click on show external code

David Thielen 3,116 Reputation points

2024-05-02T21:37:15.65+00:00

Hi;

Ok, I fixed the issue with calling NotifyAuthenticationStateChanged(). But, that doesn't change the claims attached to the cascading Task<AuthenticationState> object.

So back to the original question. How can I update the cascading Task<AuthenticationState> object?

thanks - dave

Bruce (SqlWork.com) 65,131 Reputation points

2024-05-03T16:15:07.9866667+00:00

what triggers the update? it looks like you are using a timer, so why not use the builtin:

RevalidatingServerAuthenticationStateProvider class

David Thielen 3,116 Reputation points

2024-05-04T18:29:35.3166667+00:00

I read the source for RevalidatingServerAuthenticationStateProvider - when it times out it logs the user out. I don't want that, I just want it to re-read the claims.

thanks - dave
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Can I force AuthenticationState to refresh (when claims have changed)?

1 answer

Your answer