ASP.net Identity 2.0 Sign-out another user

Question

I'm using asp.net MVC and ASP.net Identity 2.0.

On my website Admin has option to ban user, and I would like when user is banned that he is automatically signed-out from website.

I know that I can sign-out current user by calling

AuthenticationManager.SignOut();

But is it possible to sign-out another user ? Or maybe shorter his session ? Or anything ?

I know I could make global filter on controllers prohibiting banned users from access but that filter would be ran against each user so I'm not quiet satisfied with that solution.

Docilu

You should cache every ban user and then delete his cookie at the filter. – Toxoid

Answer 1

You'll need to configure cookie invalidation in Auth.Config.cs:

public void ConfigureAuth(IAppBuilder app)
{
    // important to register UserManager creation delegate. Won't work without it
    app.CreatePerOwinContext(UserManager.Create);

    app.UseCookieAuthentication(new CookieAuthenticationOptions
    {
        Provider = new CookieAuthenticationProvider
        {
            OnValidateIdentity = SecurityStampValidator
                .OnValidateIdentity<UserManager, ApplicationUser, int>(
                    validateInterval: TimeSpan.FromMinutes(10),
                    regenerateIdentityCallback: (manager, user) => user.GenerateUserIdentityAsync(manager))
        },
        // other configurations
    });

    // other stuff
}

and then update security stamp as Hao Kung says when users are banned.

I've blogged about this recently

Eterne

app.CreatePerOwinContext(UserManager.Create) - do the trick for me. I am using autofac, so in my case it looks like this: app.CreatePerOwinContext(() => DependencyResolver.Current.GetService<Db>()); app.CreatePerOwinContext(() => DependencyResolver.Current.GetService<Security.UserManager<User>>()); Where Db is DbContext and User is a class that is derived from IdentityUser – Hurdle

I don't quite understand this. I am using the standard template, so it generates app.CreatePerOwinContext<ApplicationUserManager>(ApplicationUserManager.Create); which I guess it is the same with app.CreatePerOwinContext(UserManager.Create);? It doesn't work in my case :( – Chlorobenzene

I use identity server 4 skurba but i think there is no such Middelware for .net core 6 and identity server 4 . – Gustatory

@Gustatory this answer is over 8 years old. At that time there was no .net Core, nevermind v6 of it. Of course it does not match your code. – Eterne

Answer 2

If you use the securitystampvalidator feature, when a user is banned just call: UpdateSecurityStamp(userId) to cause any existing login cookies to be invalid the next time they are checked.

More info about SecurityStamp?

Beware

I've added that line of code in my project but user wasn't logged out, can you explain me bit further how should I use it ? – Docilu

It doesn't log the user out immediately, there's the validateInterval on the security stamp which you need to configure for how often the cookie is validated. – Beware