dotnet / dotnet/aspnetcore

amr claim lost after ClaimPrincipal renewal

Open
#44,666 5 comments 4 reactions 0 assignees View on GitHub
area-identity investigate
Dominant language
C#
Stars
38.4k
Forks
10.9k
Avg merge
2d 5h
Merged PRs (30d)
276

Description

General inquiry type issue...

`amr` claim type was added in #10636 and #5783 using the `SignInWithClaimsAsync` overload on the SignInManager. When the validation interval is hit `UserClaimsPrincipalFactory.GenerateClaimsAsync` gets called to refresh the ClaimPrincipal claims but the `amr` claim is lost. Is this by design? We were attempting to put a feature behind 2fa only and using this claim as authorization. If it is suggestions on some possible workarounds? We could add this claim again in our `UserClaimsPrincipalFactory.` implementation if the user has 2fa enabled with an assumption the user did actually authenticate with it?

Recreation steps
1. new razor app with indvidual identity
2. Shorten validation interval so you don't have to wait the default 30 minutes.
```
builder.Services.Configure(options =>
{
options.ValidationInterval = TimeSpan.FromSeconds(30);
});
```
3. Signin you'll see the `amr` claim on the user.
4. Wait 30 seconds, refresh page and `amr` claim is gone

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.