4

I am using ASP.NET Identity 2 with cookie authentication. I want to add permissions of a user to the current ClaimsPrincipal but because there could be many permissions and a cookie is limited in size I don't want to serialize all claims of the identity into the cookie. I want to load the claims during login and cache them server-side. Where do I have to hook in to add the claims to the current principal on each request?

Tobias J.
  • 1,043
  • 12
  • 31

1 Answers1

2

I found the solution. The interface IAuthenticationSessionStore is exactly what I need. With an implementation of that interface, setting an instance of it on the CookieAuthenticationOptions.SessionStore property, you can decide how to persist the whole ClaimsPrincipal during the requests without serializing it into the cookie.

Tarzan, pardon, Vittorio Bertocci is presenting details to the interface here.

Tobias J.
  • 1,043
  • 12
  • 31
  • Also see this answer: http://stackoverflow.com/q/19192428/809357. Can be relevant. – trailmax Dec 05 '14 at 21:38
  • Thank you very much, @trailmax. Serializing AuthenticationTicket as the IAuthenticationSessionStore requires is no fun! Adding claims after the Identity is deserialized by the OWIN middleware from the cookie is much easier. – Tobias J. Dec 06 '14 at 04:58