{"action":"created","issue":{"url":"https://api.github.com/repos/aspnet/Security/issues/633","labels_url":"https://api.github.com/repos/aspnet/Security/issues/633/labels{/name}","comments_url":"https://api.github.com/repos/aspnet/Security/issues/633/comments","events_url":"https://api.github.com/repos/aspnet/Security/issues/633/events","html_url":"https://github.com/aspnet/Security/issues/633","id":124028145,"number":633,"title":"Changing roles (claims) for a user during a session doesn't update the claim.","user":{"login":"theonlylawislove","id":523150,"avatar_url":"https://avatars.githubusercontent.com/u/523150?v=3","gravatar_id":"","url":"https://api.github.com/users/theonlylawislove","html_url":"https://github.com/theonlylawislove","followers_url":"https://api.github.com/users/theonlylawislove/followers","following_url":"https://api.github.com/users/theonlylawislove/following{/other_user}","gists_url":"https://api.github.com/users/theonlylawislove/gists{/gist_id}","starred_url":"https://api.github.com/users/theonlylawislove/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/theonlylawislove/subscriptions","organizations_url":"https://api.github.com/users/theonlylawislove/orgs","repos_url":"https://api.github.com/users/theonlylawislove/repos","events_url":"https://api.github.com/users/theonlylawislove/events{/privacy}","received_events_url":"https://api.github.com/users/theonlylawislove/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-12-28T07:22:27Z","updated_at":"2015-12-28T10:55:31Z","closed_at":"2015-12-28T10:55:31Z","body":"If I implement the identity interfaces ```IUserRoleStore<User>``` and return a valid set a roles for a user, they get added to the user's ```ClaimsPrincipal``` for authentication.\r\n\r\nIf I update this user's role \"live\", the ```ClaimsPrincipal``` doesn't get reflected for the user until he/she logs out and back in.\r\n\r\nUser roles change dynamically in my application from background services. Is there a way I can force this to refresh?"},"comment":{"url":"https://api.github.com/repos/aspnet/Security/issues/comments/167542061","html_url":"https://github.com/aspnet/Security/issues/633#issuecomment-167542061","issue_url":"https://api.github.com/repos/aspnet/Security/issues/633","id":167542061,"user":{"login":"HaoK","id":6537861,"avatar_url":"https://avatars.githubusercontent.com/u/6537861?v=3","gravatar_id":"","url":"https://api.github.com/users/HaoK","html_url":"https://github.com/HaoK","followers_url":"https://api.github.com/users/HaoK/followers","following_url":"https://api.github.com/users/HaoK/following{/other_user}","gists_url":"https://api.github.com/users/HaoK/gists{/gist_id}","starred_url":"https://api.github.com/users/HaoK/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/HaoK/subscriptions","organizations_url":"https://api.github.com/users/HaoK/orgs","repos_url":"https://api.github.com/users/HaoK/repos","events_url":"https://api.github.com/users/HaoK/events{/privacy}","received_events_url":"https://api.github.com/users/HaoK/received_events","type":"User","site_admin":false},"created_at":"2015-12-28T10:55:31Z","updated_at":"2015-12-28T10:55:31Z","body":"SignOut/SignIn is the recommended way to clear the cookie/refresh the claims, this behavior is intentional, as by default you don't want to hit the database on every request.  "}}