Update Umbraco user's user type, based on the roles from external identity

Question

In the last few days I have been working on integrating Umbraco Backoffice with IdentityServer v3. I have managed to get to the point, where I authenticate user externally and have Umbraco create a user with some default user type in the backoffice and link it to the external account.

The next thing I'm doing is updating the Umbraco user type, based on the roles of the user. I think I found a way of doing that on linking the Umbraco to the external account, but I cannot see any way to constantly update the user types with each login, in case the roles were removed/added for a user.

By analyzing the code in Umbraco BackOfficeController, it seems there is no way to get into the process of authenticating and update data on the side of Umbraco.

var user = await UserManager.FindAsync(loginInfo.Login);
if (user != null)
{   
    await SignInManager.SignInAsync(user, isPersistent: false, rememberBrowser: false);
}
else
{
    if (await AutoLinkAndSignInExternalAccount(loginInfo) == false)
    {
        ViewBag.ExternalSignInError = new[] { "The requested provider (" + loginInfo.Login.LoginProvider + ") has not been linked to to an account" };
    }   
}

It seems that if the umbraco login is found, then the user is just being logged in, without any exposed events or options. Only if the user is not found, then the whole process of creation and linking is started, where I could actually make some changes to the user properties.

That said, is there any way to actually update the user types of an Umbraco user, based on the claims from external server, on every login?

My code from the Startup class is below.

app.UseCookieAuthentication(new CookieAuthenticationOptions
{
    AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie
});

var idAuth = new OpenIdConnectAuthenticationOptions
{
    Authority = "https://localhost:44332",
    ClientId = "id",
    ClientSecret = "secret",
    RedirectUri = "http://localhost:8081/Umbraco",
    ResponseType = "id_token token",
    Scope = "openid profile roles email",
    Caption = "test",                   

    SignInAsAuthenticationType = Umbraco.Core.Constants.Security.BackOfficeExternalAuthenticationType
};

idAuth.Notifications = new OpenIdConnectAuthenticationNotifications
{
    SecurityTokenValidated = async n =>
        {
            var id = n.AuthenticationTicket.Identity;

            var givenName = id.FindFirst(System.Security.Claims.ClaimTypes.GivenName);
            var familyName = id.FindFirst(System.Security.Claims.ClaimTypes.Surname);
            var roles = id.FindAll(System.Security.Claims.ClaimTypes.Role);

            var nid = new ClaimsIdentity(
                id.AuthenticationType,
                System.Security.Claims.ClaimTypes.GivenName,
                System.Security.Claims.ClaimTypes.Role);

            nid.AddClaim(givenName);
            nid.AddClaim(familyName);
            nid.AddClaims(roles);
            nid.AddClaim(id.FindFirst(System.Security.Claims.ClaimTypes.NameIdentifier));
            nid.AddClaim(id.FindFirst(System.Security.Claims.ClaimTypes.Email));

            n.AuthenticationTicket = new AuthenticationTicket(
                nid,
                n.AuthenticationTicket.Properties);
        }
};

//idAuth.AuthenticationType = "https://localhost:44332";
idAuth.ForUmbracoBackOffice("btn-google-plus", "fa-google-plus"); //temporary icon/button
idAuth.AuthenticationType = "https://localhost:44332";
var externalOptions = new ExternalSignInAutoLinkOptions(autoLinkExternalAccount: true, defaultUserType: "admin");
//externalOptions.OnAutoLinking; // TODO: set user type based on roles
idAuth.SetExternalSignInAutoLinkOptions(externalOptions);

app.UseOpenIdConnectAuthentication(idAuth);

Answer 1

Managed to solve this some time ago by manually checking the roles claim and Umbraco UserType on SecurityTokenValidated with the help of Umbraco services IExternalLoginService and IUserService. If the combination is not right (e.g. the administrator role is not present in the claim), I use Umbraco IUserService to update that user's UserType

Notifications = 
new OpenIdConnectAuthenticationNotifications
{
    SecurityTokenValidated = async n =>
    {
        var id = n.AuthenticationTicket.Identity;
        var uid = id.FindFirst(ClaimTypes.NameIdentifier);
        var givenName = id.FindFirst(ClaimTypes.GivenName);
        var familyName = id.FindFirst(ClaimTypes.Surname);
        var roles = id.FindAll(ClaimTypes.Role);

        var rolesList = roles as IList<Claim> ?? roles.ToList();
        if (
            !rolesList.Any(
                c =>
                    string.Equals(c.Value, RoleNames.ContentEditor,
                        StringComparison.InvariantCultureIgnoreCase)))
            throw new HttpException(403,
                "You do not have any roles configured for the application");

        // create new identity and set name and role claim type
        var nid = new ClaimsIdentity(
            id.AuthenticationType,
            ClaimTypes.GivenName,
            ClaimTypes.Role);

        UpdateUserType(uid.Value, rolesList, applicationConfiguration.AuthorityUrl);

        nid.AddClaim(givenName);
        nid.AddClaim(familyName);
        nid.AddClaims(rolesList);
        nid.AddClaim(uid);
        nid.AddClaim(id.FindFirst(ClaimTypes.Email));
        n.AuthenticationTicket = new AuthenticationTicket(
            nid,
            n.AuthenticationTicket.Properties);
    }
}



private static void UpdateUserType(string uid, IList<Claim> roles, string providerName)
    {
        var userService = ApplicationContext.Current.Services.UserService;

        var oneUser = ApplicationContext.Current.Services.ExternalLoginService.Find(new UserLoginInfo(providerName, uid)).FirstOrDefault();
        if (oneUser == null)
            return;
        var user = userService.GetUserById(oneUser.UserId);
        if (user == null)
            return;

        if (
            roles.Any(
                r => string.Equals(r.Value, RoleNames.Administrator, StringComparison.InvariantCultureIgnoreCase))
            && !string.Equals(user.UserType.Alias, UmbracoRoleNames.Administrator))
        {
            SetUserType(user, UmbracoRoleNames.Administrator, userService);
            return;
        }

        if (
            roles.Any(
                r => string.Equals(r.Value, RoleNames.ContentEditor, StringComparison.InvariantCultureIgnoreCase))
            && !string.Equals(user.UserType.Alias, UmbracoRoleNames.ContentEditor))
        {
            SetUserType(user, UmbracoRoleNames.ContentEditor, userService);
            return;
        }
    }

private static void SetUserType(Umbraco.Core.Models.Membership.IUser user, string alias, IUserService userService)
    {
        try
        {
            user.UserType = userService.GetUserTypeByAlias(alias);
            userService.Save(user);
        }
        catch (Exception e)
        {
            LogHelper.Error(typeof(ClassName), "Could not update the UserType of a user.", e);
        }
    }

In this specific case, I do not change the UserType back to a non-admin/non-content editor one when someone lacks that privilege from their roles claim, because they are being filtered out one step before and a 403 error code is being returned.