How can i sign out another user (not the currently logged one) in ASP.NET Core Identity.
I know there is a SignOutAsync() method in SignInManager, but there seems to be no override accepting user as argument. I'm looking for something like:
signInManager.SignOutAsync(user);
First update the security stamp of that user:
await userManager.UpdateSecurityStampAsync(user)
Then that user won't be noticed the changes until the arrival of the SecurityStampValidationInterval. So set it to Zero for the immediate logout:
services.AddIdentity<User, Role>(identityOptions =>
{
// enables immediate logout, after updating the user's stat.
identityOptions.SecurityStampValidationInterval = TimeSpan.Zero;
}
Update: For ASP.NET Core Identity 2.x, 3.x, 5.x
services.Configure<SecurityStampValidatorOptions>(options =>
{
// enables immediate logout, after updating the user's stat.
options.ValidationInterval = TimeSpan.Zero;
});
severely impact is just one query to the DB. If that DB is not able to handle it, change it!
one query - counting 5 extra queries on ASP.NET Core 2.X (AspNetUser, AspNetUserClaims, AspNetUserRoles,AspNetRoles, AspNetRoleClaims)
I think you might find some revoke functionality, which make sign out user forcefully. It is not easily implemented currently as the nature of stateless connection and token-based (or we can say claim-based) authentication.
A revoked user should be accessed to a token validation endpoint in order to check the token valid or not. Until then, (1) the user could be shown as a signed-in, or (2) we need to implement client(app or web) to access to the token endpoint very frequently till token expiration or revokation.
SignIn/Out is tighted to token-authorized user identity scope, so that the viable solution is to invalidate a token.
IUserSecurityStampStore.SetSecurityStampAsync(newValue) ?
