ASP.NET Identity user null after login

Question

Edit 1

Having updated the code to better handle this problem, I'm now running into the following problem:

The provided anti-forgery token was meant for a different claims-based user than the current user.

Here's the updated code:

var result = await SignInManager.PasswordSignInAsync(model.Email, model.Password, model.RememberMe, shouldLockout: false);
if (result == SignInStatus.Success)
{
    var store = new UserStore<ApplicationUser>(new ApplicationDbContext());
    var manager = new UserManager<ApplicationUser>(store);
    var user = manager.FindById(User.Identity.GetUserId());
    GenerateUserCookie(model, user, returnUrl);
}
switch (result)
{
    case SignInStatus.LockedOut:
        return View("Lockout");
    case SignInStatus.RequiresVerification:
        return RedirectToAction("SendCode", new { ReturnUrl = returnUrl, RememberMe = model.RememberMe });
    case SignInStatus.Failure:
        ModelState.AddModelError("", "Invalid login attempt.");
        return View(model);
    default:
        return View(model);
}

private ActionResult GenerateUserCookie(LoginViewModel model, ApplicationUser user, string returnUrl)
{
    if (user == null)
    {
        ModelState.AddModelError("", "Someething went wrong; please try logging in again.");
        return View(model);
    }

    var cookie = new HttpCookie("stman");
    if (user.AgentId >= 1) cookie.Values.Add("aid", user.AgentId.ToString());

    cookie.Values.Add("wumpus", user.Id.ToString());
    Response.Cookies.Add(cookie);
    return RedirectToLocal(returnUrl);
}

Original Question

Like the title says, after I log in, the user value returned by the following code is still null.

To actually get a user, I have to open the login screen again (not refresh) and log in again...

[HttpPost]
[AllowAnonymous]
[ValidateAntiForgeryToken]
public async Task<ActionResult> Login(LoginViewModel model, string returnUrl)
{
    if (!ModelState.IsValid)
    {
        return View(model);
    }

    // This doesn't count login failures towards account lockout
    // To enable password failures to trigger account lockout, change to shouldLockout: true
    var result = await SignInManager.PasswordSignInAsync(model.Email, model.Password, model.RememberMe, shouldLockout: false);
    switch (result)
    {
        case SignInStatus.Success:
            var store = new UserStore<ApplicationUser>(new ApplicationDbContext());
            var manager = new UserManager<ApplicationUser>(store);
            var user = manager.FindById(User.Identity.GetUserId());
            GenerateUserCookie(user);
            return RedirectToLocal(returnUrl);
        case SignInStatus.LockedOut:
            return View("Lockout");
        case SignInStatus.RequiresVerification:
            return RedirectToAction("SendCode", new { ReturnUrl = returnUrl, RememberMe = model.RememberMe });
        case SignInStatus.Failure:
        default:
            ModelState.AddModelError("", "Invalid login attempt.");
            return View(model);
    }
}

private void GenerateUserCookie(ApplicationUser user)
{
    var cookie = new HttpCookie("stman");

    // Throws exception most times since the user is null.
    if (user.AgentId >= 1)
    {
        cookie.Values.Add("aid", user.AgentId.ToString());
    }
    cookie.Values.Add("wumpus", user.Id.ToString());
    Response.Cookies.Add(cookie);
}

Answer 1

The issue is that User.Identity is unavailable until after you redirect. An easy way around this is to use the username rather than id to get the correct ApplicationUser .

var manager = new UserManager<ApplicationUser>(store);
var user = manager.FindByName(model.UserName);
GenerateUserCookie(user);