{"action":"created","issue":{"url":"https://api.github.com/repos/IdentityServer/IdentityServer4/issues/1815","repository_url":"https://api.github.com/repos/IdentityServer/IdentityServer4","labels_url":"https://api.github.com/repos/IdentityServer/IdentityServer4/issues/1815/labels{/name}","comments_url":"https://api.github.com/repos/IdentityServer/IdentityServer4/issues/1815/comments","events_url":"https://api.github.com/repos/IdentityServer/IdentityServer4/issues/1815/events","html_url":"https://github.com/IdentityServer/IdentityServer4/issues/1815","id":277824268,"number":1815,"title":"New user session generated when transitioning from anonymous to authenticated user","user":{"login":"tillig","id":1156571,"avatar_url":"https://avatars2.githubusercontent.com/u/1156571?v=4","gravatar_id":"","url":"https://api.github.com/users/tillig","html_url":"https://github.com/tillig","followers_url":"https://api.github.com/users/tillig/followers","following_url":"https://api.github.com/users/tillig/following{/other_user}","gists_url":"https://api.github.com/users/tillig/gists{/gist_id}","starred_url":"https://api.github.com/users/tillig/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tillig/subscriptions","organizations_url":"https://api.github.com/users/tillig/orgs","repos_url":"https://api.github.com/users/tillig/repos","events_url":"https://api.github.com/users/tillig/events{/privacy}","received_events_url":"https://api.github.com/users/tillig/received_events","type":"User","site_admin":false},"labels":[{"id":315207801,"url":"https://api.github.com/repos/IdentityServer/IdentityServer4/labels/investigating","name":"investigating","color":"eb6420","default":false}],"state":"open","locked":false,"assignee":{"login":"brockallen","id":649492,"avatar_url":"https://avatars0.githubusercontent.com/u/649492?v=4","gravatar_id":"","url":"https://api.github.com/users/brockallen","html_url":"https://github.com/brockallen","followers_url":"https://api.github.com/users/brockallen/followers","following_url":"https://api.github.com/users/brockallen/following{/other_user}","gists_url":"https://api.github.com/users/brockallen/gists{/gist_id}","starred_url":"https://api.github.com/users/brockallen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/brockallen/subscriptions","organizations_url":"https://api.github.com/users/brockallen/orgs","repos_url":"https://api.github.com/users/brockallen/repos","events_url":"https://api.github.com/users/brockallen/events{/privacy}","received_events_url":"https://api.github.com/users/brockallen/received_events","type":"User","site_admin":false},"assignees":[{"login":"brockallen","id":649492,"avatar_url":"https://avatars0.githubusercontent.com/u/649492?v=4","gravatar_id":"","url":"https://api.github.com/users/brockallen","html_url":"https://github.com/brockallen","followers_url":"https://api.github.com/users/brockallen/followers","following_url":"https://api.github.com/users/brockallen/following{/other_user}","gists_url":"https://api.github.com/users/brockallen/gists{/gist_id}","starred_url":"https://api.github.com/users/brockallen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/brockallen/subscriptions","organizations_url":"https://api.github.com/users/brockallen/orgs","repos_url":"https://api.github.com/users/brockallen/repos","events_url":"https://api.github.com/users/brockallen/events{/privacy}","received_events_url":"https://api.github.com/users/brockallen/received_events","type":"User","site_admin":false}],"milestone":null,"comments":6,"created_at":"2017-11-29T16:40:42Z","updated_at":"2017-12-06T17:56:13Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"We have a use case where we're challenging a user with security questions prior to issuing a token. The user is \"sort of anonymous\" but sort of not - we know who they _say_ they are, we just aren't totally sure yet.\r\n\r\nOver the course of the process we need to track the user's session (e.g., the JWT session ID) and they need to keep that session ID from the time they start the process to the time they log out.\r\n\r\nIn [`DefaultUserSession.CreateSessionIdAsync`](https://github.com/IdentityServer/IdentityServer4/blob/64139892d04d18ffbb43eb76d918e0d9d93ab121/src/IdentityServer4/Services/DefaultUserSession.cs#L99) I see that there is logic to not only generate a session ID if the auth properties dictionary is missing it, but _also_ if the previous subject ID isn't the same as the new subject ID.\r\n\r\nFrom the [`DefaultUserSessionTests.CreateSessionId_when_user_is_authenticated_but_different_sub_should_create_new_sid`](https://github.com/IdentityServer/IdentityServer4/blob/248828db76adf3db2b6d63a291829d49d2b088e3/test/IdentityServer.UnitTests/Services/Default/DefaultUserSessionTests.cs#L83) test I gather the idea is that if the _authenticated user changes_ then a new session ID should be created.\r\n\r\nI'm curious if the logic should be more like \"If the user _was previously authenticated_ and is now _a different authenticated user_ then create a new sid.\"\r\n\r\nThat is, instead of this:\r\n\r\n```csharp\r\nvar currentSubjectId = (await GetUserAsync())?.GetSubjectId();\r\nvar newSubjectId = principal.GetSubjectId();\r\n\r\nif (!properties.Items.ContainsKey(SessionIdKey) || currentSubjectId != newSubjectId)\r\n{\r\n  properties.Items[SessionIdKey] = CryptoRandom.CreateUniqueId(16);\r\n}\r\n```\r\n\r\nSomething like this:\r\n\r\n```csharp\r\nvar currentSubjectId = (await GetUserAsync())?.GetSubjectId();\r\nvar newSubjectId = principal.GetSubjectId();\r\n\r\nif (!properties.Items.ContainsKey(SessionIdKey) ||\r\n    (currentSubjectId != null && currentSubjectId != newSubjectId))\r\n{\r\n  properties.Items[SessionIdKey] = CryptoRandom.CreateUniqueId(16);\r\n}\r\n```\r\n\r\nThat would allow an anonymous user to transition to an authenticated user without getting a new session ID if the property is available.\r\n\r\nIs there risk in that?\r\n\r\nGranted, if #1791 gets resolved I can create my own derived `IUserSession` implementation but I'm also interested to see if this might be valuable in the default service."},"comment":{"url":"https://api.github.com/repos/IdentityServer/IdentityServer4/issues/comments/349722446","html_url":"https://github.com/IdentityServer/IdentityServer4/issues/1815#issuecomment-349722446","issue_url":"https://api.github.com/repos/IdentityServer/IdentityServer4/issues/1815","id":349722446,"user":{"login":"brockallen","id":649492,"avatar_url":"https://avatars0.githubusercontent.com/u/649492?v=4","gravatar_id":"","url":"https://api.github.com/users/brockallen","html_url":"https://github.com/brockallen","followers_url":"https://api.github.com/users/brockallen/followers","following_url":"https://api.github.com/users/brockallen/following{/other_user}","gists_url":"https://api.github.com/users/brockallen/gists{/gist_id}","starred_url":"https://api.github.com/users/brockallen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/brockallen/subscriptions","organizations_url":"https://api.github.com/users/brockallen/orgs","repos_url":"https://api.github.com/users/brockallen/repos","events_url":"https://api.github.com/users/brockallen/events{/privacy}","received_events_url":"https://api.github.com/users/brockallen/received_events","type":"User","site_admin":false},"created_at":"2017-12-06T17:56:13Z","updated_at":"2017-12-06T17:56:13Z","author_association":"OWNER","body":"And then how do your clients and APIs consume this custom session id concept? Or is it just something you're only tracking within your login UI workflow?"}}
{"actor":{"display_login":"brockallen"}}