title: Proper way to add claims to user account in ASP.NET MVC5 web app
body: <p>I am working on an ASP.NET MVC5 web app that has the following relevant properties:</p>
  
  <ul>
  <li>Uses MVC5.1, Identity 2.0, not restricted to any legacy stuff - can use newest everything.</li>
  <li>A user belongs to at least one organization.</li>
  <li>Each organization has at least one user that is an organization admin.</li>
  <li>The organization admin can allow users specific rights, such as becoming another organization admin.</li>
  <li>From what I have understood, a good way to handle this would be to use claims.</li>
  </ul>
  
  <p>In addition to the default claims, a user could then typically have the following claims:</p>
  
  <p>Organization: {some guid}
  Organization-Admin: {same guid as above}
  Organization-Publisher: {same guid again}</p>
  
  <p>There could potentially be super-admins, or even super-users, with claims giving them access to different roles in multiple organizations.</p>
  
  <p>Now, lets imagine I am user <code>admin</code> logged on to my administration panel, and I want to grant user <code>user</code> the Organization-Publisher claim for an organization that I have the Organization-Admin claim for.</p>
  
  <p>For simplicity, I have a model object that would look something like this:</p>
  
  <pre><code>public class GrantRightModel
  {
     public string OrganizationId { get; set; }
     public string UserId { get; set; }
     public string Right { get; set; }
  }
  </code></pre>
  
  <p>and for the purposes of this example, we get the following values from our <code>admin</code> user:</p>
  
  <ul>
  <li>OrganizationId: The GUID of an organization that <code>admin</code> has an Organization-Admin claim for.</li>
  <li>UserId: <code>user</code></li>
  <li>Right: Organization-Publisher</li>
  </ul>
  
  <p>There are a number of things that have evaded me about this way of doing things. Lets say we have an OrgAdmin controller with a GrantRight action;</p>
  
  <ul>
  <li><p>Will the controller action need to check that the currently logged in user (found using for instance ClaimsPrincipal.Current) has the Organizaton-Admin claim for GrantRightModel.OrganizationId "manually", or are there clever auth attributes for this kind of thing?</p></li>
  <li><p>What is the correct way in code to add the Organization-Publisher: {guid} claim to <code>user</code>? My controller will get a UserManager as necessary by dependency injection.</p></li>
  <li><p>If <code>user</code> is signed in to the application when this happens, is there a way to have him automatically have the correct claim starting with his next request? I've seen mentioned ways to do this that would cause the user to be logged out, so that he would log in again and start a fresh session with his new claims. I see why that is the way it is, but given that the user could be working on something that takes a lot of time, it might not be popular to just have him logged out when he tries to submit his work.</p></li>
  </ul>
  
  <p>There is a bit of information on this on the web, but my google-fu has failed me in finding the one that shows me how to beat these three points.</p>
  
  <p>Anyone?</p>
  
  <p>Thanks!</p>