IdentityServer4 - Best Practises to get User Information from access token

Question

I recently started developing using IdentityServer4. What I want to achieve is to have a number of independent web applications that use the same authorization server, my identity server.

My problem is how to make sure, that all my independend web applications have obtained and display the up to date user information (like firstName,lastName,avatar etc) which are stored in my IdentityServer4 database

I am aware that I should implement the IProfileService interface, to make sure that user-info endpoint will return all additional user info, but I dont know where to call this api request from my web applications. I have created a function that looks like this:

var t = await HttpContext.GetTokenAsync("access_token");
if (!String.IsNullOrEmpty(t))
{
    var client = new HttpClient();
    var userInfoRequest = new UserInfoRequest()
    {
        Address = "https://localhost:5001/connect/userinfo",
        Token = t
    };

    var response = client.GetUserInfoAsync(userInfoRequest).Result;
    if (response.IsError)
        throw new Exception("Invalid accessToken");

    dynamic responseObject = JsonConvert.DeserializeObject(response.Raw);
    string firstName = responseObject.FirstName.ToString();
    HttpContext.Session.SetString("User_FirstName", firstName);
    string lastName = responseObject.LastName.ToString();

    HttpContext.Session.SetString("User_LastName", lastName);
    HttpContext.Session.SetString("User_FullName", firstName + " " + lastName);
    if (responseObject.Image != null && !String.IsNullOrEmpty(responseObject.Image.ToString()))
    {
        string im = responseObject.Image.ToString();
        HttpContext.Session.SetString("User_Image", im);
    }
}

to get user Info from web applications.

My problem is when and how to call this function, every time the user redirects logged in from identity server to my web application, and how to make sure that Sessions will keep user associated data, for as much as the user remains logged in to my web application.

Answer 1

You can call Token Introspection endpoint to get all user info from #identityServer4.