{"action":"created","issue":{"url":"https://api.github.com/repos/aspnet/Identity/issues/1859","repository_url":"https://api.github.com/repos/aspnet/Identity","labels_url":"https://api.github.com/repos/aspnet/Identity/issues/1859/labels{/name}","comments_url":"https://api.github.com/repos/aspnet/Identity/issues/1859/comments","events_url":"https://api.github.com/repos/aspnet/Identity/issues/1859/events","html_url":"https://github.com/aspnet/Identity/issues/1859","id":337863779,"node_id":"MDU6SXNzdWUzMzc4NjM3Nzk=","number":1859,"title":"RoleClaims: Usages Designs and Questions","user":{"login":"ckams","id":32911942,"node_id":"MDQ6VXNlcjMyOTExOTQy","avatar_url":"https://avatars3.githubusercontent.com/u/32911942?v=4","gravatar_id":"","url":"https://api.github.com/users/ckams","html_url":"https://github.com/ckams","followers_url":"https://api.github.com/users/ckams/followers","following_url":"https://api.github.com/users/ckams/following{/other_user}","gists_url":"https://api.github.com/users/ckams/gists{/gist_id}","starred_url":"https://api.github.com/users/ckams/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ckams/subscriptions","organizations_url":"https://api.github.com/users/ckams/orgs","repos_url":"https://api.github.com/users/ckams/repos","events_url":"https://api.github.com/users/ckams/events{/privacy}","received_events_url":"https://api.github.com/users/ckams/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":10,"created_at":"2018-07-03T11:44:12Z","updated_at":"2018-07-06T16:05:55Z","closed_at":"2018-07-06T15:04:21Z","author_association":"NONE","body":"**Maybe I am missing something**, but I find RoleClaims \"badly considered\", even neglected.\r\n\r\nWhereas Role Claims/Group Claims are **essential for intranet Apps (Windows authentication), and \"general\" group membership**—without them, it will lead to some repetitive code, **or to write custom Identity**— I find that they are not \"user friendly\".\r\n\r\nSo I have some questions, and will share some thoughts.\r\n\r\n## Usages of RoleClaims\r\nWhat is the purpose of RoleClaims in Identity?\r\n- How to use them **accordingly to you**?\r\n    - This subject is not documented.\r\n    - I find no sample on github;\r\n- Do you consider to remove them in the future?\r\n    - It seems—badly considered—and that it could be…\r\n    - if yes, how you will replace them? (How??? Knowing that, most of us cannot rely on something \"ephemeral\")\r\n\r\n## Design and limitations\r\nIf we want to use RoleClaims as it should (in a many-to-many relationship) like AspNetUserRoles table, we find that some pieces are missing…\r\n- No documentation…\r\n- No many-to-many relationship table between Roles and Claims, ready to use;\r\n- Weird property `public virtual TKey RoleId { get; set; }` in `IdentityRoleClaim`;\r\n- Not ready to use in `AuthorizationHandler` as\r\n    - Nothing ready to use in `ClaimsIdentity` and `ClaimsPrincipal` classes, to get RoleClaims;\r\n    - If we use DI in `AuthorizationHandler`, we have to register the `AuthorizationHandler` as `scope` to get access to RoleManager/UserManager, etc…\r\n\r\n## Consequences\r\n- We have to do some choice: singleton vs RoleClaims access;\r\n- Write many-to-many relationship table between Roles and RoleClaims;\r\n- Keeping useless property `public virtual TKey RoleId { get; set; }` in `IdentityRoleClaim`;\r\n\r\n**But If we want to get something nice and simple, particularly with `AuthorizationHandler`:**\r\n- With or without the current RoleClaims Api, we have to dive into Identity Customization, **because nothing is ready to use as it should be…**\r\n\r\n## Conclusion\r\nCan you reconsider the importance of RoleClaims in Identity, and provide us \"a better design\"?"},"comment":{"url":"https://api.github.com/repos/aspnet/Identity/issues/comments/403077272","html_url":"https://github.com/aspnet/Identity/issues/1859#issuecomment-403077272","issue_url":"https://api.github.com/repos/aspnet/Identity/issues/1859","id":403077272,"node_id":"MDEyOklzc3VlQ29tbWVudDQwMzA3NzI3Mg==","user":{"login":"ckams","id":32911942,"node_id":"MDQ6VXNlcjMyOTExOTQy","avatar_url":"https://avatars3.githubusercontent.com/u/32911942?v=4","gravatar_id":"","url":"https://api.github.com/users/ckams","html_url":"https://github.com/ckams","followers_url":"https://api.github.com/users/ckams/followers","following_url":"https://api.github.com/users/ckams/following{/other_user}","gists_url":"https://api.github.com/users/ckams/gists{/gist_id}","starred_url":"https://api.github.com/users/ckams/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ckams/subscriptions","organizations_url":"https://api.github.com/users/ckams/orgs","repos_url":"https://api.github.com/users/ckams/repos","events_url":"https://api.github.com/users/ckams/events{/privacy}","received_events_url":"https://api.github.com/users/ckams/received_events","type":"User","site_admin":false},"created_at":"2018-07-06T16:05:55Z","updated_at":"2018-07-06T16:05:55Z","author_association":"NONE","body":"I agree, but \r\n- it will be better/easier to understand with a doc… **for now nothing is easy in the flexibility/customization** (even if I succeed to do what I want, it costs me too much time because of the lack of documentation)…\r\n- ACL is not something too much complex for enterprise level app… (I used to code in PHP, and Zend frameworks, Joomla, etc… provide ACL. With all due respect, In comparison, Identity looks like a back to the Past…)\r\n- nothing prevents to suggest some improvements, **[or do not mention community involvement](https://www.asp.net/open-source)**…\r\n- you should \"write\" for customers, not for simplicity sake… And I used to think that ASP.NET Core was for writing enterprise level app, not to write simple blogs…\r\n\r\nAnyway, while waiting for your documentation, I wish you a good day."}}
{"actor":{"display_login":"ckams"}}