Why does UserClaimsPrincipalFactory<TUser> ignore IUserRoleStore?

[ebejko]

When configuring identity through AddIdentityCore and using a custom store that implements IUserRoleStore, role claims are ignored during the ClaimsPrincipal creation. UserManager exposes SupportsUserRole and GetRolesAsync, which abstract the underlying IUserRoleStore, but they are not used. To include roles in the ClaimsPrincipal, the framework requires switching to UserClaimsPrincipalFactory<TUser, TRole> or implementing a custom factory.

Is there a specific architectural reason why role claims are tied to the presence of RoleManager with a TRole enitty and not to the IUserRoleStore?

[engineering87]

Yes @ebejko it’s intentional
IUserRoleStore is just persistence. The ClaimsPrincipal is built by UserClaimsPrincipalFactory, which works through managers (like RoleManager), not stores. Roles are also opt-in with AddIdentityCore.
So the default pipeline doesn’t expand roles into claims unless RoleManager is there.

[ebejko]

Hey @engineering87, thanks for the reply. It makes sense more or less, but I am still arguing about adding roles in claims through UserManager.SupportsUserRole, not through the stores themselves. If in my custom implementation SupportsUserRole returns true, it seems contradictory for roles to not be included in claims by default.