dotnet / dotnet/aspnetcore

Always signed out after 30 minutes--more info

Open
#53,658 1 comment 0 reactions 0 assignees View on GitHub
area-identity bug
Dominant language
C#
Stars
38.4k
Forks
10.9k
Avg merge
2d 10h
Merged PRs (30d)
281

Description

### Is there an existing issue for this?

- [X] I have searched the existing issues

### Describe the bug

Issue #5786 addresses a similar problem but doesn't describe the situation I experience.

I have implemented a custom UserClaimsPrincipalFactory and a custom UserStore, which does not inherit from UserStoreBase. When the app attempts to authenticate a ticket older than 30 minutes, it forces SignOut. All I have to go on are the following messages in the Log

Microsoft.AspNetCore.Identity.SignInManager: Debug: Failed to validate a security stamp.
Microsoft.AspNetCore.Identity.SecurityStampValidator: Debug: Security stamp validation failed, rejecting cookie.

So the first problem is that SecurityStampValidator.ValidateAsync does not check if UserManager.SupportsUserSecurityStamp is true before checking if validation is required, ie. timeElapsed > Options.ValidationInterval (which defaults to 30 minutes). In my case that would have avoided the problem, since my UserStore does not support IUserSecurityStampStore.

The second problem turns out to be that my CustomUserClaimsPrincipalFactory did not add UserIdClaim when creating the ClaimPrincipal, so SignManager.ValidateSecurityStampAsync fails since it doesn't know the Id of the user to validate. It's probably arguable whether it should revalidate the ticket if UserManager.SupportsUserSecurityStamp is true but it can't find the underlying user. It would be worth a LogWarning in this case at least.

### Expected Behavior

Authentication should not be signed out for SecurityStamp if it is not supported

Add LogWarnings when a claim required by the authentication service is missing.

### Steps To Reproduce

_No response_

### Exceptions (if any)

_No response_

### .NET Version

8.0.101

### Anything else?

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.