Identityserver3 Update Permissions

Question

I wondering if i could update the current user claims w/o the user having to authenticate again.

In my case the user will log into the application and will receive a set of claims. Later he will be able to change the customer his working with. Once that is done he need to receive a new set of claims.

Does any one know if that can be done?

Thanks in advance.

Answer 1

You almost answered your own question - a token is not a good place to store permissions, because the only way to update the token content is to get a new token.

Tokens are good from transmitting immutable identity data. Everything else belongs into the realm of application or business logic design.