title: ASP.NET Identity sign out another user
body: <p>Just like in this <a href="https://stackoverflow.com/questions/25878218/asp-net-identity-2-0-sign-out-another-user">question</a>, I want to sign out another user via updating the Security Stamp. However it doesn't work when testing on my local machine. I suspect the problem might be with the order of commands I'm using to reset a user and persisting the different properties to the db.</p>
  
  <p>That's my <code>Startup.Auth</code></p>
  
  <pre><code>public partial class Startup
  {
      public static TimeSpan expireTimeSpan = TimeSpan.FromHours(24);
      public static IDataProtectionProvider DataProtectionProvider { get; private set; }
  
      public void ConfigureAuth(IAppBuilder app)
      {
          app.CreatePerOwinContext(() =&gt; DependencyResolver.Current.GetService&lt;ApplicationUserManager&gt;());
  
          app.UseCookieAuthentication(new CookieAuthenticationOptions
          {
              AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
              ExpireTimeSpan = expireTimeSpan,
              Provider = new CookieAuthenticationProvider
              {
                  OnValidateIdentity = SecurityStampValidator.OnValidateIdentity&lt;ApplicationUserManager, ApplicationUser&gt;(
                      validateInterval: TimeSpan.FromMinutes(30),
                      regenerateIdentity: (manager, user) =&gt; user.GenerateUserIdentityAsync(manager))
              }
          });
  
          DataProtectionProvider = app.GetDataProtectionProvider();
      }
  }
  </code></pre>
  
  <p>And this is a controller method that allows changing another users email == username. On changing the email, the user is supposed to be logged out and not have a valid password anymore.</p>
  
  <pre><code>public async Task&lt;IHttpActionResult&gt; UpdateUser(string id, ApplicationUser newUser)
  {
      var user = await _userManager.FindByIdAsync(id);
      if (user == null) ...
  
      IdentityResult result;
  
      user.name = newUser.name;
      user.roles = newUser.roles;
  
      // sign out user and invalidate password
      if (user.email != newUser.email)
      {
          user.email = newUser.email;
          user.PasswordHash = null;
  
          result = await _userManager.UpdateSecurityStampAsync(user.Id);
          if (!result.Succeeded) throw new Exception("Security Stamp not updated.");
  
          await _account.SendPasswordEmail(user);
      }
  
      result = await _userManager.UpdateAsync(user);
      if (!result.Succeeded)
          return GetErrorResult(result);
  
      return Ok();
  }
  </code></pre>
  
  <p>I have tried persisting the user first, then generating a new <code>SecurityStamp</code>, but that didn't work either.</p>
  
  <p>Any ideas what could be wrong?</p>
  
  <p>Thanks!</p>