Add cookie authentication validator for primary authentication type

[cortex93]

Hi,

Would it be possible to add SecurityStampValidator support to ids. This would allow to invalidate persistent cookie.
From Microsoft Identity samples:

 app.UseCookieAuthentication(new CookieAuthenticationOptions
            {
                AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
                LoginPath = new PathString("/Account/Login"),
                Provider = new CookieAuthenticationProvider
                {
                    // Enables the application to validate the security stamp when the user logs in.
                    // This is a security feature which is used when you change a password or add an external login to your account.  
                    OnValidateIdentity = SecurityStampValidator.OnValidateIdentity<ApplicationUserManager, ApplicationUser>(
                        validateInterval: TimeSpan.FromMinutes(30),
                        regenerateIdentity: (manager, user) => user.GenerateUserIdentityAsync(manager))
                }
            });

[leastprivilege]

Could you explain more why you want that?

[brockallen]

I suspect they want the authentication cookie to be invalidated if the user has changed their password. I think we can achieve that by calling IsActive on the user service passing the identity from the authentication cookie.

[cortex93]

Yes, a custom IUserService would return an AuthenticationResult with an identity with a secret value claim. Then, the cookie authent middleware would call to check if the secret value is still the known one. If not, the cookie is invalidated.
Calling IsActive each time the cookie authentication happens would be fine, I guess. Despite the name would not reveal clear intent.

[brockallen]

For now, we're making this post-RTM.

[brockallen]

This can now be done via IsActive on the user service, as it's invoked from the authorize endpoint. I have a TODO to show in a sample: #482.