title: Custom UserStore for ASP.NET Core Identity
body: <p>Based on the implementation published on <a href="https://github.com/hiiru/AspNet.Identity.DocumentDb/blob/master/src/AspNet.Identity.DocumentDb/UserStore.cs" rel="nofollow noreferrer">GitHub</a> I have made my own <strong>UserStore</strong> and <strong>RoleStore</strong> which don't use the <strong>Entity Framework</strong> (I currently need only a simple list of users in memory before I attach to a real data base). To be able to do this, I had to change the registration. I have written my own <a href="https://github.com/aspnet/Identity/blob/dev/src/Microsoft.AspNetCore.Identity.EntityFrameworkCore/IdentityEntityFrameworkBuilderExtensions.cs" rel="nofollow noreferrer">IdentityEntityFrameworkBuilderExtensions</a> without DbContext and with TryAddSingleton instead of TryAddScoped, so once initialized list of users can last through the app lifespan. The problem is, the Dispose method is called so many times... I do not dispose anything, but there are so many calls. Is it because I made the <strong>UserStore</strong> and <strong>RoleStore</strong> singleton, even though everything else works as they were scoped?</p>
  
  <p>The second thing is, what is the neccessary minimum to accomplish the working <strong>UserStore</strong>? </p>
  
  <p><a href="https://stackoverflow.com/questions/20657487/mvc-5-custom-userstore">danludwig wrote</a> you need only <em>IUserStore</em> and <em>IUserPasswordStore</em> and it is very probable, because I did a store implementing those two interfaces and a <strong>RoleStore</strong> with <em>IRoleStore</em> and it seemd to work. I did also the <strong>RoleStore</strong> because of the <code>services.AddIdentity&lt;ApplicationUser, IdentityRole&gt;()</code> part in startup class. I used an <strong>Entity Framework</strong> authorization template for <em>ASP.NET Core Web Application</em> (with <em>Individual User Accounts</em>).</p>
  
  <p><a href="https://stackoverflow.com/questions/22652543/does-new-asp-net-mvc-identity-framework-work-without-entity-framework-and-sql-se">Arve Systad and Anderson Matos</a> wrote that you need those 8:</p>
  
  <ol>
  <li><code>IUserStore&lt;TUser&gt;</code></li>
  <li><code>IUserPasswordStore&lt;TUser&gt;</code></li>
  <li><code>IUserTwoFactorStore&lt;TUser&gt;</code></li>
  <li><code>IUserClaimStore&lt;TUser&gt;</code></li>
  <li><code>IRoleStore&lt;TRole&gt;</code></li>
  <li><code>IUserSecurityStampStore&lt;TUser, string&gt;</code></li>
  <li><code>IUserRoleStore&lt;TUser, string&gt;</code></li>
  <li><code>UserManager&lt;TUser&gt;</code></li>
  </ol>
  
  <p>After I deleted all of the <strong>Entity Framework</strong> packages, I have learned that it provides only the <strong>UserStore</strong> and <strong>RoleStore</strong> which implement (based on the source code from GitHub):</p>
  
  <ol>
  <li>IUserLoginStore,</li>
  <li>IUserRoleStore,</li>
  <li>IUserClaimStore,</li>
  <li>IUserPasswordStore,</li>
  <li>IUserSecurityStampStore,</li>
  <li>IUserEmailStore,</li>
  <li>IUserLockoutStore,</li>
  <li>IUserPhoneNumberStore,</li>
  <li>IQueryableUserStore,</li>
  <li>IUserTwoFactorStore,</li>
  <li>IUserAuthenticationTokenStore</li>
  </ol>
  
  <p>And:</p>
  
  <ol start="12">
  <li>IQueryableRoleStore,</li>
  <li>IRoleClaimStore</li>
  </ol>
  
  <p>After deleting the packages, I tried to do a minum scenario <strong>UserStore</strong> and <strong>RoleStore</strong> for the <strong>Entity Framework</strong> authentication template and I got to:</p>
  
  <ol>
  <li>IQueryableUserStore,</li>
  <li>IUserPasswordStore,</li>
  <li>IUserSecurityStampStore,</li>
  <li>IUserLockoutStore,</li>
  <li>IUserTwoFactorStore,</li>
  <li>IUserRoleStore,</li>
  <li>IUserClaimStore</li>
  </ol>
  
  <p>And probably only IRoleStore, becasuse only a Dispose method is being called. Most of the interfaces provide only a Get... during the app lifetime. While adding a user, I get some setters called, but they come from <strong>IQueryableUserStore</strong>, <strong>IUserPasswordStore</strong>, <strong>IUserSecurityStampStore</strong> and <strong>IUserLockoutStore</strong>. Do I really need all those interfaces?</p>
  
  <p><strong>EDIT:</strong></p>
  
  <p>My current post-EF <strong>UserStore</strong> looks like this with implemented only mentioned methods:</p>
  
  <pre><code>public class MyUserStore&lt;TUser&gt; :
      IQueryableUserStore&lt;TUser&gt;,
      IUserPasswordStore&lt;TUser&gt;,
      IUserSecurityStampStore&lt;TUser&gt;
      where TUser : MyIdentity
  {
      private List&lt;TUser&gt; _identities = new List&lt;TUser&gt;();
      CreateAsync(...)
      FindByIdAsync(...)
      FindByNameAsync(...)
      GetPasswordHashAsync(...)
      GetSecurityStampAsync(...)
      GetUserIdAsync(...)
      GetUserNameAsync(...)
      SetNormalizedUserNameAsync(...)
      SetPasswordHashAsync(...)
      SetSecurityStampAsync(...)
  }
  </code></pre>
  
  <p>The last thing I'd like to ask is the purpose of setter methods in <strong>UserStore</strong>. They mostly set some additional properties in the Identity:</p>
  
  <pre><code>    public async Task SetNormalizedUserNameAsync(TUser user, string normalizedName, CancellationToken cancellationToken)
      {
          cancellationToken.ThrowIfCancellationRequested();
          ThrowIfDisposed();
          if (user == null)
          {
              throw new ArgumentNullException("user");
          }
          user.NormalizedUserName = normalizedName;
          await UpdateAsync(user, cancellationToken);
      }
  </code></pre>
  
  <p>Why? Is this a step for some kind of data base side validation? It's kind of weird when you check the path the app goes through while adding a new user and it starts from <em>SetPasswordHashAsync</em> and ends with <em>CreateAsync</em>... :P</p>