Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Refreshing Tokens with Claims Principal #336

Open
DomsRoberts opened this issue Sep 22, 2021 · 1 comment
Open

Refreshing Tokens with Claims Principal #336

DomsRoberts opened this issue Sep 22, 2021 · 1 comment
Assignees
Labels

Comments

@DomsRoberts
Copy link

There is an earlier issues raised about the Claims Principal not being present in a RefreshTokenResult, it doesn't appear to have been addressed.
I am using the LoginResult with the Claims Prinicipals to authenticate who is using my system. When the Token expires I want to be able to refresh that Token and then continue using the Claims to validate the permissions of the User.
The RefreshTokenAsync code does not create the Claims Principal and it is not possible to create a LoginResult as the Setters are internal.
What is the correct way to Refresh a token and continue to use the Claims from the original LoginResult?

@josephdecock
Copy link
Contributor

The assumption is that the client application is going to extract the claims identity and tokens from the login result, and store them in some way that is appropriate for the platform. And similarly, when you refresh a token, you'd take the new access token out of the RefreshResult and replace the old access token with the new one. At that point, there's no reason that you couldn't keep using the claims principal from before the refresh.

In other words, don't try to store everything in an instance of one of the result types, because that's not what they're intended for.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Development

No branches or pull requests

2 participants