1

Let's say I have and custom STS which authenticates users of a web app. This STS also has data like user id, name and e-mail address. I have the following situation:

I have an application that uses the STS. In this application users can create a record, and one of the properties then will be 'creator' filled with user id. If people search for this record I want to show them the real name and not the user id. So I need to somehow keep a relation from user id to real name.

Problem: In the database of the application I only have a user id, but I want to show specific user details. What's the best way to do this? I thought about adding a method to my STS, that let's me query for additional user data, but that would be very slow If i need to show like 50 records on screen which all have different user id's. Another solution is to keep a table in my app with user data. A user is added to this table when 'the user' is used for the first time by my app. But how and when do you synchronize this table?

I think I prefer solution 2, and just sync data every night or so.

What do you guys think?

Thomas
  • 59
  • 6

1 Answers1

2

Can you modify the schema of your database?

If you can, then you could get name and other user property information from the STS and then save it on your side (maybe on the user database or in the associated record). You would treat this as "reference" data for querying and displaying only and would not allow edits.

Every time a user authenticates (and presents a token with all these claims) you would simply update the information on your database. For this to work you need a good unique id (the userid?) that can be used as the permanent, trusted handle for users.

Eugenio Pace
  • 14,094
  • 1
  • 34
  • 43
  • Thank you. Good to hear that it's a fine solution to create a 'read-only' user table in the application database. Updating this table on the authentication event looks fine for most of the time. I think we can come up with a few situations where users are referenced (as 'reader' or something), but they never log into the system, but we'll work something out for that. – Thomas Feb 24 '11 at 10:33
  • plase give an advice. What claim or claims combination could be used as an unique permanent user id? – Anthony Serdyukov Apr 28 '11 at 05:49
  • Is your "userid" not good enough? People often use e-mails too. Some IdP provide some kind of nameidentifier (e.g. LiveID, Google, etc). – Eugenio Pace Apr 28 '11 at 22:05
  • Thanks, @Eugenio. I'm in doubt what claim to choose for **permanent cross-RP** user identifier. Probably you could answer my question http://stackoverflow.com/questions/5814017/what-is-the-purpose-of-nameidentifier-claim – Anthony Serdyukov Apr 29 '11 at 05:43