Let’s say I have and custom STS which authenticates users of a web app. This STS also has data like user id, name and e-mail address.
I have the following situation:
I have an application that uses the STS. In this application users can create a record, and one of the properties then will be ‘creator’ filled with user id. If people search for this record I want to show them the real name and not the user id. So I need to somehow keep a relation from user id to real name.
Problem: In the database of the application I only have a user id, but I want to show specific user details. What’s the best way to do this?
I thought about adding a method to my STS, that let’s me query for additional user data, but that would be very slow If i need to show like 50 records on screen which all have different user id’s.
Another solution is to keep a table in my app with user data. A user is added to this table when ‘the user’ is used for the first time by my app. But how and when do you synchronize this table?
I think I prefer solution 2, and just sync data every night or so.
What do you guys think?
Can you modify the schema of your database?
If you can, then you could get name and other user property information from the STS and then save it on your side (maybe on the user database or in the associated record). You would treat this as “reference” data for querying and displaying only and would not allow edits.
Every time a user authenticates (and presents a token with all these claims) you would simply update the information on your database. For this to work you need a good unique id (the userid?) that can be used as the permanent, trusted handle for users.