{"action":"created","issue":{"url":"https://api.github.com/repos/brockallen/BrockAllen.MembershipReboot/issues/648","repository_url":"https://api.github.com/repos/brockallen/BrockAllen.MembershipReboot","labels_url":"https://api.github.com/repos/brockallen/BrockAllen.MembershipReboot/issues/648/labels{/name}","comments_url":"https://api.github.com/repos/brockallen/BrockAllen.MembershipReboot/issues/648/comments","events_url":"https://api.github.com/repos/brockallen/BrockAllen.MembershipReboot/issues/648/events","html_url":"https://github.com/brockallen/BrockAllen.MembershipReboot/issues/648","id":155753060,"number":648,"title":"Claims and login by cookie","user":{"login":"justSteve","id":103760,"avatar_url":"https://avatars.githubusercontent.com/u/103760?v=3","gravatar_id":"","url":"https://api.github.com/users/justSteve","html_url":"https://github.com/justSteve","followers_url":"https://api.github.com/users/justSteve/followers","following_url":"https://api.github.com/users/justSteve/following{/other_user}","gists_url":"https://api.github.com/users/justSteve/gists{/gist_id}","starred_url":"https://api.github.com/users/justSteve/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/justSteve/subscriptions","organizations_url":"https://api.github.com/users/justSteve/orgs","repos_url":"https://api.github.com/users/justSteve/repos","events_url":"https://api.github.com/users/justSteve/events{/privacy}","received_events_url":"https://api.github.com/users/justSteve/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-05-19T14:38:10Z","updated_at":"2016-05-19T14:41:47Z","closed_at":null,"body":"Understanding that newly added claims do not become operative within a current session - the user has to have logged in to see the effect of a new claim.\r\n\r\nI'm struggling with scenarios where users are returning to my site into an authenticated session based on the FedAuth cookie but do not see claims that were added since their last visit. But as soon as they logoff and re-log in, the claim is visible.\r\n\r\nI'm using the UserClaims table in what I believe to be the correct convention - I have a FK relation to UserAccounts and add claims of my own type as the result of user transactions. So the user could have multiple UserClaims of type: `http://myDomain.com/ws/2014/01/identity/claims/DisplayMaterial`:\r\n\r\n```\r\n{\"OrderId\":93442,\"ExpiresDate\":\"2016-07-13\",\"OnDemandCode\":\"ti5j\"}\r\n{\"OrderId\":117314,\"ExpiresDate\":\"2016-11-03\",\"OnDemandCode\":\"mdhn\"}\r\n```\r\nIf the claim with OrderId 117314 was issued since the user's last visit/login, it's not visible until he logs off and back in.\r\n\r\nI can't be sure but I believe this is intermittent. Based on my site's overall volume vs the number of problem reports I'm getting I have the sense that at least **some** users are seeing newly added claims without the logoff/login requirement. \r\n\r\nIt would be very helpful to have a definitive understanding of what I should expect (in terms of Claims behavior) in situations where authentication is via FedAuth instead of the explicit login dialog.\r\n\r\nIn case it comes into play - I'm using a fairly old version of MR \r\n```\r\n  <package id=\"BrockAllen.MembershipReboot\" version=\"8.2.1\" targetFramework=\"net451\" />\r\n  <package id=\"BrockAllen.MembershipReboot.Ef\" version=\"8.0.0\" targetFramework=\"net451\" />\r\n  <package id=\"BrockAllen.MembershipReboot.WebHost\" version=\"7.1.0\" targetFramework=\"net451\" />\r\n```\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/brockallen/BrockAllen.MembershipReboot/issues/comments/220345353","html_url":"https://github.com/brockallen/BrockAllen.MembershipReboot/issues/648#issuecomment-220345353","issue_url":"https://api.github.com/repos/brockallen/BrockAllen.MembershipReboot/issues/648","id":220345353,"user":{"login":"brockallen","id":649492,"avatar_url":"https://avatars.githubusercontent.com/u/649492?v=3","gravatar_id":"","url":"https://api.github.com/users/brockallen","html_url":"https://github.com/brockallen","followers_url":"https://api.github.com/users/brockallen/followers","following_url":"https://api.github.com/users/brockallen/following{/other_user}","gists_url":"https://api.github.com/users/brockallen/gists{/gist_id}","starred_url":"https://api.github.com/users/brockallen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/brockallen/subscriptions","organizations_url":"https://api.github.com/users/brockallen/orgs","repos_url":"https://api.github.com/users/brockallen/repos","events_url":"https://api.github.com/users/brockallen/events{/privacy}","received_events_url":"https://api.github.com/users/brockallen/received_events","type":"User","site_admin":false},"created_at":"2016-05-19T14:41:47Z","updated_at":"2016-05-19T14:41:47Z","body":"> Understanding that newly added claims do not become operative within a current session - the user has to have logged in to see the effect of a new claim.\r\n\r\nOr you can just re-issue the cookie if the app knows the claims have changed.\r\n\r\nIn any event, this issue is not a MR specific problem -- it's a data in 2 places problem. If the data changes then your app somehow would need to know it's changed and re-issue the cookie."}}