From a5395f4e1ee01f8da478fae796b9b5f793c0d431 Mon Sep 17 00:00:00 2001
From: Mike Alhayek <mike@crestapps.com>
Date: Tue, 19 Dec 2023 13:04:15 -0800
Subject: [PATCH] Maintain claims principal during refresh (#14918)

---
 .../OrchardCore.Users/Startup.cs              |  2 +-
 .../Services/ConfigureSecurityStampOptions.cs | 35 +++++++++++++++++++
 2 files changed, 36 insertions(+), 1 deletion(-)
 create mode 100644 src/OrchardCore/OrchardCore.Users.Core/Services/ConfigureSecurityStampOptions.cs

diff --git a/src/OrchardCore.Modules/OrchardCore.Users/Startup.cs b/src/OrchardCore.Modules/OrchardCore.Users/Startup.cs
index 21ec8b3c407..06a547db5ca 100644
--- a/src/OrchardCore.Modules/OrchardCore.Users/Startup.cs
+++ b/src/OrchardCore.Modules/OrchardCore.Users/Startup.cs
@@ -206,7 +206,7 @@ public override void ConfigureServices(IServiceCollection services)
                 options.LogoutPath = "/" + userOptions.Value.LogoffPath;
                 options.AccessDeniedPath = "/Error/403";
             });
-
+            services.AddTransient<IPostConfigureOptions<SecurityStampValidatorOptions>, ConfigureSecurityStampOptions>();
             services.AddDataMigration<Migrations>();
 
             services.AddScoped<IUserClaimsProvider, EmailClaimsProvider>();
diff --git a/src/OrchardCore/OrchardCore.Users.Core/Services/ConfigureSecurityStampOptions.cs b/src/OrchardCore/OrchardCore.Users.Core/Services/ConfigureSecurityStampOptions.cs
new file mode 100644
index 00000000000..01cc9d179b2
--- /dev/null
+++ b/src/OrchardCore/OrchardCore.Users.Core/Services/ConfigureSecurityStampOptions.cs
@@ -0,0 +1,35 @@
+using System.Linq;
+using System.Security.Claims;
+using System.Threading.Tasks;
+using Microsoft.AspNetCore.Identity;
+using Microsoft.Extensions.Options;
+
+namespace OrchardCore.Users.Services;
+
+public class ConfigureSecurityStampOptions : IPostConfigureOptions<SecurityStampValidatorOptions>
+{
+    public void PostConfigure(string name, SecurityStampValidatorOptions options)
+    {
+        options.OnRefreshingPrincipal = principalContext =>
+        {
+            var currentIdentity = principalContext.CurrentPrincipal?.Identities?.FirstOrDefault();
+
+            if (currentIdentity is not null && principalContext.NewPrincipal.Identities is not null)
+            {
+                var newIdentity = principalContext.NewPrincipal.Identities.First();
+
+                foreach (var claim in currentIdentity.Claims)
+                {
+                    if (newIdentity.HasClaim(claim.Type, claim.Value))
+                    {
+                        continue;
+                    }
+
+                    newIdentity.AddClaim(new Claim(claim.Type, claim.Value));
+                }
+            }
+
+            return Task.CompletedTask;
+        };
+    }
+}