New Users domain.

src/Squidex.Domain.Apps.Core/Apps/PermissionLevel.cs

@@ -5,6 +5,7 @@
 //  Copyright (c) Squidex Group
 //  All rights reserved.
 // ==========================================================================
+
 namespace Squidex.Domain.Apps.Core.Apps
 {
     public enum PermissionLevel

src/Squidex.Domain.Apps.Core/Identity/SquidexClaimTypes.cs

@@ -5,6 +5,7 @@
 //  Copyright (c) Squidex Group
 //  All rights reserved.
 // ==========================================================================
+
 namespace Squidex.Domain.Apps.Core.Identity
 {
     public static class SquidexClaimTypes

src/Squidex.Domain.Apps.Core/Identity/SquidexRoles.cs

@@ -5,6 +5,7 @@
 //  Copyright (c) Squidex Group
 //  All rights reserved.
 // ==========================================================================
+
 namespace Squidex.Domain.Apps.Core.Identity
 {
     public static class SquidexRoles

src/Squidex.Domain.Apps.Core/Schemas/BooleanFieldEditor.cs

@@ -5,6 +5,7 @@
 //  Copyright (c) Squidex Group
 //  All rights reserved.
 // ==========================================================================
+
 namespace Squidex.Domain.Apps.Core.Schemas
 {
     public enum BooleanFieldEditor

src/Squidex.Domain.Apps.Core/Schemas/DateTimeCalculatedDefaultValue.cs

@@ -5,6 +5,7 @@
 //  Copyright (c) Squidex Group
 //  All rights reserved.
 // ==========================================================================
+
 namespace Squidex.Domain.Apps.Core.Schemas
 {
     public enum DateTimeCalculatedDefaultValue

src/Squidex.Domain.Apps.Core/Schemas/DateTimeFieldEditor.cs

@@ -5,6 +5,7 @@
 //  Copyright (c) Squidex Group
 //  All rights reserved.
 // ==========================================================================
+
 namespace Squidex.Domain.Apps.Core.Schemas
 {
     public enum DateTimeFieldEditor

src/Squidex.Domain.Apps.Core/Schemas/GeolocationFieldEditor.cs

@@ -5,6 +5,7 @@
 //  Copyright (c) Squidex Group
 //  All rights reserved.
 // ==========================================================================
+
 namespace Squidex.Domain.Apps.Core.Schemas
 {
     public enum GeolocationFieldEditor

src/Squidex.Domain.Apps.Core/Schemas/NumberFieldEditor.cs

@@ -5,6 +5,7 @@
 //  Copyright (c) Squidex Group
 //  All rights reserved.
 // ==========================================================================
+
 namespace Squidex.Domain.Apps.Core.Schemas
 {
     public enum NumberFieldEditor

src/Squidex.Domain.Apps.Core/Schemas/SchemaProperties.cs

@@ -5,6 +5,7 @@
 //  Copyright (c) Squidex Group
 //  All rights reserved.
 // ==========================================================================
+
 namespace Squidex.Domain.Apps.Core.Schemas
 {
     public sealed class SchemaProperties : NamedElementPropertiesBase

src/Squidex.Domain.Apps.Core/Schemas/StringFieldEditor.cs

@@ -5,6 +5,7 @@
 //  Copyright (c) Squidex Group
 //  All rights reserved.
 // ==========================================================================
+
 namespace Squidex.Domain.Apps.Core.Schemas
 {
     public enum StringFieldEditor

src/Squidex.Domain.Apps.Read.MongoDb/Squidex.Domain.Apps.Read.MongoDb.csproj

@@ -24,9 +24,4 @@
   <ItemGroup Condition=" '$(TargetFramework)' == 'netstandard1.6' ">
     <PackageReference Include="Microsoft.OData.Core" Version="6.15.0" />
   </ItemGroup>
-  <ItemGroup>
-    <Reference Include="System.Reflection.Metadata">
-      <HintPath>C:\Users\mail2\.nuget\packages\system.reflection.metadata\1.4.1\lib\netstandard1.1\System.Reflection.Metadata.dll</HintPath>
-    </Reference>
-  </ItemGroup>
 </Project>

src/Squidex.Domain.Apps.Read/Apps/IAppClientEntity.cs

@@ -5,6 +5,7 @@
 //  Copyright (c) Squidex Group
 //  All rights reserved.
 // ==========================================================================
+
 namespace Squidex.Domain.Apps.Read.Apps
 {
     public interface IAppClientEntity

src/Squidex.Domain.Apps.Read/Apps/Services/IAppLimitsPlan.cs

@@ -5,6 +5,7 @@
 //  Copyright (c) Squidex Group
 //  All rights reserved.
 // ==========================================================================
+
 namespace Squidex.Domain.Apps.Read.Apps.Services
 {
     public interface IAppLimitsPlan

src/Squidex.Domain.Apps.Read/Apps/Services/Implementations/ConfigAppLimitsPlan.cs

@@ -5,6 +5,7 @@
 //  Copyright (c) Squidex Group
 //  All rights reserved.
 // ==========================================================================
+
 namespace Squidex.Domain.Apps.Read.Apps.Services.Implementations
 {
     public sealed class ConfigAppLimitsPlan : IAppLimitsPlan

src/Squidex.Domain.Apps.Read/Assets/IAssetEntity.cs

@@ -5,6 +5,7 @@
 //  Copyright (c) Squidex Group
 //  All rights reserved.
 // ==========================================================================
+
 namespace Squidex.Domain.Apps.Read.Assets
 {
     public interface IAssetEntity : IAppRefEntity, IEntityWithCreatedBy, IEntityWithLastModifiedBy, IEntityWithVersion

src/Squidex.Domain.Apps.Read/IEntityWithVersion.cs

@@ -5,6 +5,7 @@
 //  Copyright (c) Squidex Group
 //  All rights reserved.
 // ==========================================================================
+
 namespace Squidex.Domain.Apps.Read
 {
     public interface IEntityWithVersion

src/Squidex.Domain.Apps.Read/Schemas/WebhookResult.cs

@@ -5,6 +5,7 @@
 //  Copyright (c) Squidex Group
 //  All rights reserved.
 // ==========================================================================
+
 namespace Squidex.Domain.Apps.Read.Schemas
 {
     public enum WebhookResult

src/Squidex.Domain.Apps.Read/Users/ExternalLogin.cs

@@ -5,6 +5,7 @@
 //  Copyright (c) Squidex Group
 //  All rights reserved.
 // ==========================================================================
+
 namespace Squidex.Domain.Apps.Read.Users
 {
     public sealed class ExternalLogin

src/Squidex.Domain.Apps.Read/Users/IRole.cs

@@ -5,6 +5,7 @@
 //  Copyright (c) Squidex Group
 //  All rights reserved.
 // ==========================================================================
+
 namespace Squidex.Domain.Apps.Read.Users
 {
     public interface IRole

src/Squidex.Domain.Apps.Read/Users/IRoleFactory.cs

@@ -5,6 +5,7 @@
 //  Copyright (c) Squidex Group
 //  All rights reserved.
 // ==========================================================================
+
 namespace Squidex.Domain.Apps.Read.Users
 {
     public interface IRoleFactory

src/Squidex.Domain.Apps.Read/Users/IUserFactory.cs

@@ -5,6 +5,7 @@
 //  Copyright (c) Squidex Group
 //  All rights reserved.
 // ==========================================================================
+
 namespace Squidex.Domain.Apps.Read.Users
 {
     public interface IUserFactory

src/Squidex.Domain.Apps.Write/Assets/Commands/DeleteAsset.cs

@@ -5,6 +5,7 @@
 //  Copyright (c) Squidex Group
 //  All rights reserved.
 // ==========================================================================
+
 namespace Squidex.Domain.Apps.Write.Assets.Commands
 {
     public sealed class DeleteAsset : AssetAggregateCommand

src/Squidex.Domain.Apps.Write/Contents/Commands/DeleteContent.cs

@@ -5,6 +5,7 @@
 //  Copyright (c) Squidex Group
 //  All rights reserved.
 // ==========================================================================
+
 namespace Squidex.Domain.Apps.Write.Contents.Commands
 {
     public class DeleteContent : ContentCommand

src/Squidex.Domain.Apps.Write/Contents/Commands/PatchContent.cs

@@ -5,6 +5,7 @@
 //  Copyright (c) Squidex Group
 //  All rights reserved.
 // ==========================================================================
+
 namespace Squidex.Domain.Apps.Write.Contents.Commands
 {
     public class PatchContent : ContentDataCommand

src/Squidex.Domain.Apps.Write/Contents/Commands/PublishContent.cs

@@ -5,6 +5,7 @@
 //  Copyright (c) Squidex Group
 //  All rights reserved.
 // ==========================================================================
+
 namespace Squidex.Domain.Apps.Write.Contents.Commands
 {
     public class PublishContent : ContentCommand

src/Squidex.Domain.Apps.Write/Contents/Commands/UnpublishContent.cs

@@ -5,6 +5,7 @@
 //  Copyright (c) Squidex Group
 //  All rights reserved.
 // ==========================================================================
+
 namespace Squidex.Domain.Apps.Write.Contents.Commands
 {
     public class UnpublishContent : ContentCommand

src/Squidex.Domain.Apps.Write/Contents/Commands/UpdateContent.cs

@@ -5,6 +5,7 @@
 //  Copyright (c) Squidex Group
 //  All rights reserved.
 // ==========================================================================
+
 namespace Squidex.Domain.Apps.Write.Contents.Commands
 {
     public class UpdateContent : ContentDataCommand

src/Squidex.Domain.Apps.Write/Schemas/Commands/DeleteField.cs

@@ -5,6 +5,7 @@
 //  Copyright (c) Squidex Group
 //  All rights reserved.
 // ==========================================================================
+
 namespace Squidex.Domain.Apps.Write.Schemas.Commands
 {
     public class DeleteField : FieldCommand

src/Squidex.Domain.Apps.Write/Schemas/Commands/DeleteSchema.cs

@@ -5,6 +5,7 @@
 //  Copyright (c) Squidex Group
 //  All rights reserved.
 // ==========================================================================
+
 namespace Squidex.Domain.Apps.Write.Schemas.Commands
 {
     public class DeleteSchema : SchemaAggregateCommand

src/Squidex.Domain.Apps.Write/Schemas/Commands/DisableField.cs

@@ -5,6 +5,7 @@
 //  Copyright (c) Squidex Group
 //  All rights reserved.
 // ==========================================================================
+
 namespace Squidex.Domain.Apps.Write.Schemas.Commands
 {
     public class DisableField : FieldCommand

src/Squidex.Domain.Apps.Write/Schemas/Commands/EnableField.cs

@@ -5,6 +5,7 @@
 //  Copyright (c) Squidex Group
 //  All rights reserved.
 // ==========================================================================
+
 namespace Squidex.Domain.Apps.Write.Schemas.Commands
 {
     public class EnableField : FieldCommand

src/Squidex.Domain.Apps.Write/Schemas/Commands/FieldCommand.cs

@@ -5,6 +5,7 @@
 //  Copyright (c) Squidex Group
 //  All rights reserved.
 // ==========================================================================
+
 namespace Squidex.Domain.Apps.Write.Schemas.Commands
 {
     public class FieldCommand : SchemaAggregateCommand

src/Squidex.Domain.Apps.Write/Schemas/Commands/HideField.cs

@@ -5,6 +5,7 @@
 //  Copyright (c) Squidex Group
 //  All rights reserved.
 // ==========================================================================
+
 namespace Squidex.Domain.Apps.Write.Schemas.Commands
 {
     public class HideField : FieldCommand

src/Squidex.Domain.Apps.Write/Schemas/Commands/PublishSchema.cs

@@ -5,6 +5,7 @@
 //  Copyright (c) Squidex Group
 //  All rights reserved.
 // ==========================================================================
+
 namespace Squidex.Domain.Apps.Write.Schemas.Commands
 {
     public class PublishSchema : SchemaAggregateCommand

src/Squidex.Domain.Apps.Write/Schemas/Commands/ShowField.cs

@@ -5,6 +5,7 @@
 //  Copyright (c) Squidex Group
 //  All rights reserved.
 // ==========================================================================
+
 namespace Squidex.Domain.Apps.Write.Schemas.Commands
 {
     public class ShowField : FieldCommand

src/Squidex.Domain.Apps.Write/Schemas/Commands/UnpublishSchema.cs

@@ -5,6 +5,7 @@
 //  Copyright (c) Squidex Group
 //  All rights reserved.
 // ==========================================================================
+
 namespace Squidex.Domain.Apps.Write.Schemas.Commands
 {
     public class UnpublishSchema : SchemaAggregateCommand

src/Squidex.Domain.Users.MongoDb/MongoRoleStore.cs

@@ -0,0 +1,92 @@
+// ==========================================================================
+//  MongoRoleStore.cs
+//  Squidex Headless CMS
+// ==========================================================================
+//  Copyright (c) Squidex Group
+//  All rights reserved.
+// ==========================================================================
+
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.AspNetCore.Identity;
+using Microsoft.AspNetCore.Identity.MongoDB;
+using MongoDB.Driver;
+
+namespace Squidex.Domain.Users.MongoDb
+{
+    public sealed class MongoRoleStore : 
+        IRoleStore<IRole>, 
+        IRoleFactory
+    {
+        private readonly RoleStore<WrappedIdentityRole> innerStore;
+
+        public MongoRoleStore(IMongoDatabase database)
+        {
+            var rolesCollection = database.GetCollection<WrappedIdentityRole>("Identity_Roles");
+
+            IndexChecks.EnsureUniqueIndexOnNormalizedRoleName(rolesCollection);
+
+            innerStore = new RoleStore<WrappedIdentityRole>(rolesCollection);
+        }
+
+        public void Dispose()
+        {
+            innerStore.Dispose();
+        }
+
+        public IRole Create(string name)
+        {
+            return new WrappedIdentityRole { Name = name };
+        }
+
+        public async Task<IRole> FindByIdAsync(string roleId, CancellationToken cancellationToken)
+        {
+            return await innerStore.FindByIdAsync(roleId, cancellationToken);
+        }
+
+        public async Task<IRole> FindByNameAsync(string normalizedRoleName, CancellationToken cancellationToken)
+        {
+            return await innerStore.FindByNameAsync(normalizedRoleName, cancellationToken);
+        }
+
+        public Task<IdentityResult> CreateAsync(IRole role, CancellationToken cancellationToken)
+        {
+            return innerStore.CreateAsync((WrappedIdentityRole)role, cancellationToken);
+        }
+
+        public Task<IdentityResult> UpdateAsync(IRole role, CancellationToken cancellationToken)
+        {
+            return innerStore.UpdateAsync((WrappedIdentityRole)role, cancellationToken);
+        }
+
+        public Task<IdentityResult> DeleteAsync(IRole role, CancellationToken cancellationToken)
+        {
+            return innerStore.DeleteAsync((WrappedIdentityRole)role, cancellationToken);
+        }
+
+        public Task<string> GetRoleIdAsync(IRole role, CancellationToken cancellationToken)
+        {
+            return innerStore.GetRoleIdAsync((WrappedIdentityRole)role, cancellationToken);
+        }
+
+        public Task<string> GetRoleNameAsync(IRole role, CancellationToken cancellationToken)
+        {
+            return innerStore.GetRoleNameAsync((WrappedIdentityRole)role, cancellationToken);
+        }
+
+        public Task SetRoleNameAsync(IRole role, string roleName, CancellationToken cancellationToken)
+        {
+            return innerStore.SetRoleNameAsync((WrappedIdentityRole)role, roleName, cancellationToken);
+        }
+
+        public Task<string> GetNormalizedRoleNameAsync(IRole role, CancellationToken cancellationToken)
+        {
+            return innerStore.GetNormalizedRoleNameAsync((WrappedIdentityRole)role, cancellationToken);
+        }
+
+        public Task SetNormalizedRoleNameAsync(IRole role, string normalizedName, CancellationToken cancellationToken)
+        {
+            return innerStore.SetNormalizedRoleNameAsync((WrappedIdentityRole)role, normalizedName, cancellationToken);
+        }
+    }
+}

src/Squidex.Domain.Users.MongoDb/MongoUserStore.cs

@@ -0,0 +1,329 @@
+// ==========================================================================
+//  MongoUserStore.cs
+//  Squidex Headless CMS
+// ==========================================================================
+//  Copyright (c) Squidex Group
+//  All rights reserved.
+// ==========================================================================
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Security.Claims;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.AspNetCore.Identity;
+using Microsoft.AspNetCore.Identity.MongoDB;
+using MongoDB.Driver;
+using Squidex.Shared.Users;
+
+namespace Squidex.Domain.Users.MongoDb
+{
+    public sealed class MongoUserStore :
+        IUserPasswordStore<IUser>, 
+        IUserRoleStore<IUser>, 
+        IUserLoginStore<IUser>, 
+        IUserSecurityStampStore<IUser>, 
+        IUserEmailStore<IUser>, 
+        IUserClaimStore<IUser>, 
+        IUserPhoneNumberStore<IUser>, 
+        IUserTwoFactorStore<IUser>, 
+        IUserLockoutStore<IUser>, 
+        IUserAuthenticationTokenStore<IUser>,
+        IUserFactory,
+        IUserResolver,
+        IQueryableUserStore<IUser>
+    {
+        private readonly UserStore<WrappedIdentityUser> innerStore;
+
+        public MongoUserStore(IMongoDatabase database)
+        {
+            var usersCollection = database.GetCollection<WrappedIdentityUser>("Identity_Users");
+
+            IndexChecks.EnsureUniqueIndexOnNormalizedEmail(usersCollection);
+            IndexChecks.EnsureUniqueIndexOnNormalizedUserName(usersCollection);
+
+            innerStore = new UserStore<WrappedIdentityUser>(usersCollection);
+        }
+
+        public void Dispose()
+        {
+            innerStore.Dispose();
+        }
+
+        public IQueryable<IUser> Users
+        {
+            get { return innerStore.Users; }
+        }
+
+        public IUser Create(string email)
+        {
+            return new WrappedIdentityUser { Email = email, UserName = email };
+        }
+
+        public async Task<IUser> FindByIdAsync(string userId)
+        {
+            return await innerStore.FindByIdAsync(userId, CancellationToken.None);
+        }
+
+        public async Task<IUser> FindByIdAsync(string userId, CancellationToken cancellationToken)
+        {
+            return await innerStore.FindByIdAsync(userId, cancellationToken);
+        }
+
+        public async Task<IUser> FindByEmailAsync(string normalizedEmail, CancellationToken cancellationToken)
+        {
+            return await innerStore.FindByEmailAsync(normalizedEmail, cancellationToken);
+        }
+
+        public async Task<IUser> FindByNameAsync(string normalizedUserName, CancellationToken cancellationToken)
+        {
+            return await innerStore.FindByNameAsync(normalizedUserName, cancellationToken);
+        }
+
+        public async Task<IUser> FindByLoginAsync(string loginProvider, string providerKey, CancellationToken cancellationToken)
+        {
+            return await innerStore.FindByLoginAsync(loginProvider, providerKey, cancellationToken);
+        }
+
+        public async Task<IList<IUser>> GetUsersForClaimAsync(Claim claim, CancellationToken cancellationToken)
+        {
+            return (await innerStore.GetUsersForClaimAsync(claim, cancellationToken)).OfType<IUser>().ToList();
+        }
+
+        public async Task<IList<IUser>> GetUsersInRoleAsync(string roleName, CancellationToken cancellationToken)
+        {
+            return (await innerStore.GetUsersInRoleAsync(roleName, cancellationToken)).OfType<IUser>().ToList();
+        }
+
+        public Task<IdentityResult> CreateAsync(IUser user, CancellationToken cancellationToken)
+        {
+            return innerStore.CreateAsync((WrappedIdentityUser)user, cancellationToken);
+        }
+
+        public Task<IdentityResult> UpdateAsync(IUser user, CancellationToken cancellationToken)
+        {
+            return innerStore.UpdateAsync((WrappedIdentityUser)user, cancellationToken);
+        }
+
+        public Task<IdentityResult> DeleteAsync(IUser user, CancellationToken cancellationToken)
+        {
+            return innerStore.DeleteAsync((WrappedIdentityUser)user, cancellationToken);
+        }
+
+        public Task<string> GetUserIdAsync(IUser user, CancellationToken cancellationToken)
+        {
+            return innerStore.GetUserIdAsync((WrappedIdentityUser)user, cancellationToken);
+        }
+
+        public Task<string> GetUserNameAsync(IUser user, CancellationToken cancellationToken)
+        {
+            return innerStore.GetUserNameAsync((WrappedIdentityUser)user, cancellationToken);
+        }
+
+        public Task SetUserNameAsync(IUser user, string userName, CancellationToken cancellationToken)
+        {
+            return innerStore.SetUserNameAsync((WrappedIdentityUser)user, userName, cancellationToken);
+        }
+
+        public Task<string> GetNormalizedUserNameAsync(IUser user, CancellationToken cancellationToken)
+        {
+            return innerStore.GetNormalizedUserNameAsync((WrappedIdentityUser)user, cancellationToken);
+        }
+
+        public Task SetNormalizedUserNameAsync(IUser user, string normalizedName, CancellationToken cancellationToken)
+        {
+            return innerStore.SetNormalizedUserNameAsync((WrappedIdentityUser)user, normalizedName, cancellationToken);
+        }
+
+        public Task<string> GetPasswordHashAsync(IUser user, CancellationToken cancellationToken)
+        {
+            return innerStore.GetPasswordHashAsync((WrappedIdentityUser)user, cancellationToken);
+        }
+
+        public Task SetPasswordHashAsync(IUser user, string passwordHash, CancellationToken cancellationToken)
+        {
+            return innerStore.SetPasswordHashAsync((WrappedIdentityUser)user, passwordHash, cancellationToken);
+        }
+
+        public Task AddToRoleAsync(IUser user, string roleName, CancellationToken cancellationToken)
+        {
+            return innerStore.AddToRoleAsync((WrappedIdentityUser)user, roleName, cancellationToken);
+        }
+
+        public Task RemoveFromRoleAsync(IUser user, string roleName, CancellationToken cancellationToken)
+        {
+            return innerStore.RemoveFromRoleAsync((WrappedIdentityUser)user, roleName, cancellationToken);
+        }
+
+        public Task<IList<string>> GetRolesAsync(IUser user, CancellationToken cancellationToken)
+        {
+            return innerStore.GetRolesAsync((WrappedIdentityUser)user, cancellationToken);
+        }
+
+        public Task<bool> IsInRoleAsync(IUser user, string roleName, CancellationToken cancellationToken)
+        {
+            return innerStore.IsInRoleAsync((WrappedIdentityUser)user, roleName, cancellationToken);
+        }
+
+        public Task AddLoginAsync(IUser user, UserLoginInfo login, CancellationToken cancellationToken)
+        {
+            return innerStore.AddLoginAsync((WrappedIdentityUser)user, login, cancellationToken);
+        }
+
+        public Task RemoveLoginAsync(IUser user, string loginProvider, string providerKey, CancellationToken cancellationToken)
+        {
+            return innerStore.RemoveLoginAsync((WrappedIdentityUser)user, loginProvider, providerKey, cancellationToken);
+        }
+
+        public Task<IList<UserLoginInfo>> GetLoginsAsync(IUser user, CancellationToken cancellationToken)
+        {
+            return innerStore.GetLoginsAsync((WrappedIdentityUser)user, cancellationToken);
+        }
+
+        public Task<string> GetSecurityStampAsync(IUser user, CancellationToken cancellationToken)
+        {
+            return innerStore.GetSecurityStampAsync((WrappedIdentityUser)user, cancellationToken);
+        }
+
+        public Task SetSecurityStampAsync(IUser user, string stamp, CancellationToken cancellationToken)
+        {
+            return innerStore.SetSecurityStampAsync((WrappedIdentityUser)user, stamp, cancellationToken);
+        }
+
+        public Task<string> GetEmailAsync(IUser user, CancellationToken cancellationToken)
+        {
+            return innerStore.GetEmailAsync((WrappedIdentityUser)user, cancellationToken);
+        }
+
+        public Task SetEmailAsync(IUser user, string email, CancellationToken cancellationToken)
+        {
+            return innerStore.SetEmailAsync((WrappedIdentityUser)user, email, cancellationToken);
+        }
+
+        public Task<bool> GetEmailConfirmedAsync(IUser user, CancellationToken cancellationToken)
+        {
+            return innerStore.GetEmailConfirmedAsync((WrappedIdentityUser)user, cancellationToken);
+        }
+
+        public Task SetEmailConfirmedAsync(IUser user, bool confirmed, CancellationToken cancellationToken)
+        {
+            return innerStore.SetEmailConfirmedAsync((WrappedIdentityUser)user, confirmed, cancellationToken);
+        }
+
+        public Task<string> GetNormalizedEmailAsync(IUser user, CancellationToken cancellationToken)
+        {
+            return innerStore.GetNormalizedEmailAsync((WrappedIdentityUser)user, cancellationToken);
+        }
+
+        public Task SetNormalizedEmailAsync(IUser user, string normalizedEmail, CancellationToken cancellationToken)
+        {
+            return innerStore.SetNormalizedEmailAsync((WrappedIdentityUser)user, normalizedEmail, cancellationToken);
+        }
+
+        public Task<IList<Claim>> GetClaimsAsync(IUser user, CancellationToken cancellationToken)
+        {
+            return innerStore.GetClaimsAsync((WrappedIdentityUser)user, cancellationToken);
+        }
+
+        public Task AddClaimsAsync(IUser user, IEnumerable<Claim> claims, CancellationToken cancellationToken)
+        {
+            return innerStore.AddClaimsAsync((WrappedIdentityUser)user, claims, cancellationToken);
+        }
+
+        public Task ReplaceClaimAsync(IUser user, Claim claim, Claim newClaim, CancellationToken cancellationToken)
+        {
+            return innerStore.ReplaceClaimAsync((WrappedIdentityUser)user, claim, newClaim, cancellationToken);
+        }
+
+        public Task RemoveClaimsAsync(IUser user, IEnumerable<Claim> claims, CancellationToken cancellationToken)
+        {
+            return innerStore.RemoveClaimsAsync((WrappedIdentityUser)user, claims, cancellationToken);
+        }
+
+        public Task<string> GetPhoneNumberAsync(IUser user, CancellationToken cancellationToken)
+        {
+            return innerStore.GetPhoneNumberAsync((WrappedIdentityUser)user, cancellationToken);
+        }
+
+        public Task SetPhoneNumberAsync(IUser user, string phoneNumber, CancellationToken cancellationToken)
+        {
+            return innerStore.SetPhoneNumberAsync((WrappedIdentityUser)user, phoneNumber, cancellationToken);
+        }
+
+        public Task<bool> GetPhoneNumberConfirmedAsync(IUser user, CancellationToken cancellationToken)
+        {
+            return innerStore.GetPhoneNumberConfirmedAsync((WrappedIdentityUser)user, cancellationToken);
+        }
+
+        public Task SetPhoneNumberConfirmedAsync(IUser user, bool confirmed, CancellationToken cancellationToken)
+        {
+            return innerStore.SetPhoneNumberConfirmedAsync((WrappedIdentityUser)user, confirmed, cancellationToken);
+        }
+
+        public Task<bool> GetTwoFactorEnabledAsync(IUser user, CancellationToken cancellationToken)
+        {
+            return innerStore.GetTwoFactorEnabledAsync((WrappedIdentityUser)user, cancellationToken);
+        }
+
+        public Task SetTwoFactorEnabledAsync(IUser user, bool enabled, CancellationToken cancellationToken)
+        {
+            return innerStore.SetTwoFactorEnabledAsync((WrappedIdentityUser)user, enabled, cancellationToken);
+        }
+
+        public Task<DateTimeOffset?> GetLockoutEndDateAsync(IUser user, CancellationToken cancellationToken)
+        {
+            return innerStore.GetLockoutEndDateAsync((WrappedIdentityUser)user, cancellationToken);
+        }
+
+        public Task SetLockoutEndDateAsync(IUser user, DateTimeOffset? lockoutEnd, CancellationToken cancellationToken)
+        {
+            return innerStore.SetLockoutEndDateAsync((WrappedIdentityUser)user, lockoutEnd, cancellationToken);
+        }
+
+        public Task<int> GetAccessFailedCountAsync(IUser user, CancellationToken cancellationToken)
+        {
+            return innerStore.GetAccessFailedCountAsync((WrappedIdentityUser)user, cancellationToken);
+        }
+
+        public Task<int> IncrementAccessFailedCountAsync(IUser user, CancellationToken cancellationToken)
+        {
+            return innerStore.IncrementAccessFailedCountAsync((WrappedIdentityUser)user, cancellationToken);
+        }
+
+        public Task ResetAccessFailedCountAsync(IUser user, CancellationToken cancellationToken)
+        {
+            return innerStore.ResetAccessFailedCountAsync((WrappedIdentityUser)user, cancellationToken);
+        }
+
+        public Task<bool> GetLockoutEnabledAsync(IUser user, CancellationToken cancellationToken)
+        {
+            return innerStore.GetLockoutEnabledAsync((WrappedIdentityUser)user, cancellationToken);
+        }
+
+        public Task SetLockoutEnabledAsync(IUser user, bool enabled, CancellationToken cancellationToken)
+        {
+            return innerStore.SetLockoutEnabledAsync((WrappedIdentityUser)user, enabled, cancellationToken);
+        }
+
+        public Task SetTokenAsync(IUser user, string loginProvider, string name, string value, CancellationToken cancellationToken)
+        {
+            return innerStore.SetTokenAsync((WrappedIdentityUser)user, loginProvider, name, value, cancellationToken);
+        }
+
+        public Task RemoveTokenAsync(IUser user, string loginProvider, string name, CancellationToken cancellationToken)
+        {
+            return innerStore.RemoveTokenAsync((WrappedIdentityUser)user, loginProvider, name, cancellationToken);
+        }
+
+        public Task<string> GetTokenAsync(IUser user, string loginProvider, string name, CancellationToken cancellationToken)
+        {
+            return innerStore.GetTokenAsync((WrappedIdentityUser)user, loginProvider, name, cancellationToken);
+        }
+
+        public Task<bool> HasPasswordAsync(IUser user, CancellationToken cancellationToken)
+        {
+            return Task.FromResult(!string.IsNullOrWhiteSpace(((WrappedIdentityUser)user).PasswordHash));
+        }
+    }
+}

src/Squidex.Domain.Users.MongoDb/Squidex.Domain.Users.MongoDb.csproj

@@ -0,0 +1,19 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <TargetFramework>netstandard1.6</TargetFramework>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|AnyCPU'">
+    <DebugType>full</DebugType>
+    <DebugSymbols>True</DebugSymbols>
+  </PropertyGroup>
+  <ItemGroup>
+    <ProjectReference Include="..\Squidex.Domain.Users\Squidex.Domain.Users.csproj" />
+    <ProjectReference Include="..\Squidex.Infrastructure\Squidex.Infrastructure.csproj" />
+    <ProjectReference Include="..\Squidex.Shared\Squidex.Shared.csproj" />
+  </ItemGroup>
+  <ItemGroup>
+    <PackageReference Include="Microsoft.AspNetCore.Identity" Version="1.1.2" />
+    <PackageReference Include="Microsoft.AspNetCore.Identity.MongoDB" Version="1.0.2" />
+    <PackageReference Include="MongoDB.Driver" Version="2.4.4" />
+  </ItemGroup>
+</Project>

src/Squidex.Domain.Users.MongoDb/WrappedIdentityRole.cs

@@ -0,0 +1,16 @@
+// ==========================================================================
+//  WrappedIdentityRole.cs
+//  Squidex Headless CMS
+// ==========================================================================
+//  Copyright (c) Squidex Group
+//  All rights reserved.
+// ==========================================================================
+
+using Microsoft.AspNetCore.Identity.MongoDB;
+
+namespace Squidex.Domain.Users.MongoDb
+{
+    public sealed class WrappedIdentityRole : IdentityRole, IRole
+    {
+    }
+}

src/Squidex.Domain.Users.MongoDb/WrappedIdentityUser.cs

@@ -0,0 +1,46 @@
+// ==========================================================================
+//  WrappedIdentityUser.cs
+//  Squidex Headless CMS
+// ==========================================================================
+//  Copyright (c) Squidex Group
+//  All rights reserved.
+// ==========================================================================
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Security.Claims;
+using Microsoft.AspNetCore.Identity.MongoDB;
+using Squidex.Shared.Users;
+
+namespace Squidex.Domain.Users.MongoDb
+{
+    public sealed class WrappedIdentityUser : IdentityUser, IUser
+    {
+        public bool IsLocked
+        {
+            get { return LockoutEndDateUtc != null && LockoutEndDateUtc.Value > DateTime.UtcNow; }
+        }
+
+        IReadOnlyList<Claim> IUser.Claims
+        {
+            get { return Claims.Select(x => new Claim(x.Type, x.Value)).ToList(); }
+        }
+
+        IReadOnlyList<ExternalLogin> IUser.Logins
+        {
+            get { return Logins.Select(x => new ExternalLogin(x.LoginProvider, x.ProviderKey, x.ProviderDisplayName)).ToList(); }
+        }
+
+        public void UpdateEmail(string email)
+        {
+            Email = UserName = email;
+        }
+
+        public void SetClaim(string type, string value)
+        {
+            Claims.RemoveAll(x => string.Equals(x.Type, type, StringComparison.OrdinalIgnoreCase));
+            Claims.Add(new IdentityUserClaim { Type = type, Value = value });
+        }
+    }
+}

src/Squidex.Domain.Users/AssetUserPictureStore.cs

@@ -0,0 +1,43 @@
+// ==========================================================================
+//  AssetUserPictureStore.cs
+//  Squidex Headless CMS
+// ==========================================================================
+//  Copyright (c) Squidex Group
+//  All rights reserved.
+// ==========================================================================
+
+using System.IO;
+using System.Threading.Tasks;
+using Squidex.Infrastructure;
+using Squidex.Infrastructure.Assets;
+
+namespace Squidex.Domain.Users
+{
+    public sealed class AssetUserPictureStore : IUserPictureStore
+    {
+        private readonly IAssetStore assetStore;
+
+        public AssetUserPictureStore(IAssetStore assetStore)
+        {
+            Guard.NotNull(assetStore, nameof(assetStore));
+
+            this.assetStore = assetStore;
+        }
+
+        public Task UploadAsync(string userId, Stream stream)
+        {
+            return assetStore.UploadAsync(userId, 0, "picture", stream);
+        }
+
+        public async Task<Stream> DownloadAsync(string userId)
+        {
+            var memoryStream = new MemoryStream();
+
+            await assetStore.DownloadAsync(userId, 0, "picture", memoryStream);
+
+            memoryStream.Position = 0;
+
+            return memoryStream;
+        }
+    }
+}

src/Squidex.Domain.Users/IRole.cs

@@ -0,0 +1,15 @@
+// ==========================================================================
+//  IRole.cs
+//  Squidex Headless CMS
+// ==========================================================================
+//  Copyright (c) Squidex Group
+//  All rights reserved.
+// ==========================================================================
+
+namespace Squidex.Domain.Users
+{
+    public interface IRole
+    {
+        string Name { get; }
+    }
+}

src/Squidex.Domain.Users/IRoleFactory.cs

@@ -0,0 +1,15 @@
+// ==========================================================================
+//  IRoleFactory.cs
+//  Squidex Headless CMS
+// ==========================================================================
+//  Copyright (c) Squidex Group
+//  All rights reserved.
+// ==========================================================================
+
+namespace Squidex.Domain.Users
+{
+    public interface IRoleFactory
+    {
+        IRole Create(string name);
+    }
+}

src/Squidex.Domain.Users/IUserFactory.cs

@@ -0,0 +1,17 @@
+// ==========================================================================
+//  IUserFactory.cs
+//  Squidex Headless CMS
+// ==========================================================================
+//  Copyright (c) Squidex Group
+//  All rights reserved.
+// ==========================================================================
+
+using Squidex.Shared.Users;
+
+namespace Squidex.Domain.Users
+{
+    public interface IUserFactory
+    {
+        IUser Create(string email);
+    }
+}

src/Squidex.Domain.Users/IUserPictureStore.cs

@@ -0,0 +1,20 @@
+// ==========================================================================
+//  IUserPictureStore.cs
+//  Squidex Headless CMS
+// ==========================================================================
+//  Copyright (c) Squidex Group
+//  All rights reserved.
+// ==========================================================================
+
+using System.IO;
+using System.Threading.Tasks;
+
+namespace Squidex.Domain.Users
+{
+    public interface IUserPictureStore
+    {
+        Task UploadAsync(string userId, Stream stream);
+
+        Task<Stream> DownloadAsync(string userId);
+    }
+}

src/Squidex.Domain.Users/Squidex.Domain.Users.csproj

@@ -0,0 +1,17 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <TargetFramework>netstandard1.6</TargetFramework>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|AnyCPU'">
+    <DebugType>full</DebugType>
+    <DebugSymbols>True</DebugSymbols>
+  </PropertyGroup>
+  <ItemGroup>
+    <ProjectReference Include="..\Squidex.Infrastructure\Squidex.Infrastructure.csproj" />
+    <ProjectReference Include="..\Squidex.Shared\Squidex.Shared.csproj" />
+  </ItemGroup>
+  <ItemGroup>
+    <PackageReference Include="Microsoft.AspNetCore.Identity" Version="1.1.2" />
+    <PackageReference Include="System.Linq.Queryable" Version="4.3.0" />
+  </ItemGroup>
+</Project>

src/Squidex.Domain.Users/UserExtensions.cs

@@ -0,0 +1,75 @@
+// ==========================================================================
+//  UserExtensions.cs
+//  Squidex Headless CMS
+// ==========================================================================
+//  Copyright (c) Squidex Group
+//  All rights reserved.
+// ==========================================================================
+
+using System;
+using System.Linq;
+using Squidex.Infrastructure;
+using Squidex.Shared.Identity;
+using Squidex.Shared.Users;
+
+// ReSharper disable InvertIf
+
+namespace Squidex.Domain.Users
+{
+    public static class UserExtensions
+    {
+        public static void UpdateDisplayName(this IUser user, string displayName)
+        {
+            user.SetClaim(SquidexClaimTypes.SquidexDisplayName, displayName);
+        }
+
+        public static void SetPictureUrl(this IUser user, string pictureUrl)
+        {
+            user.SetClaim(SquidexClaimTypes.SquidexPictureUrl, pictureUrl);
+        }
+
+        public static void SetPictureUrlToStore(this IUser user)
+        {
+            user.SetClaim(SquidexClaimTypes.SquidexPictureUrl, "store");
+        }
+
+        public static void SetPictureUrlFromGravatar(this IUser user, string email)
+        {
+            user.SetClaim(SquidexClaimTypes.SquidexPictureUrl, GravatarHelper.CreatePictureUrl(email));
+        }
+
+        public static bool IsPictureUrlStored(this IUser user)
+        {
+            return string.Equals(user.Claims.FirstOrDefault(x => x.Type == SquidexClaimTypes.SquidexPictureUrl)?.Value, "store", StringComparison.OrdinalIgnoreCase);
+        }
+
+        public static string PictureUrl(this IUser user)
+        {
+            return user.Claims.FirstOrDefault(x => x.Type == SquidexClaimTypes.SquidexPictureUrl)?.Value;
+        }
+
+        public static string DisplayName(this IUser user)
+        {
+            return user.Claims.FirstOrDefault(x => x.Type == SquidexClaimTypes.SquidexDisplayName)?.Value;
+        }
+
+        public static string PictureNormalizedUrl(this IUser user)
+        {
+            var url = user.Claims.FirstOrDefault(x => x.Type == SquidexClaimTypes.SquidexPictureUrl)?.Value;
+
+            if (!string.IsNullOrWhiteSpace(url) && Uri.IsWellFormedUriString(url, UriKind.Absolute) && url.Contains("gravatar"))
+            {
+                if (url.Contains("?"))
+                {
+                    url += "&d=404";
+                }
+                else
+                {
+                    url += "?d=404";
+                }
+            }
+
+            return url;
+        }
+    }
+}

src/Squidex.Domain.Users/UserManagerExtensions.cs

@@ -0,0 +1,132 @@
+// ==========================================================================
+//  UserManagerExtensions.cs
+//  Squidex Headless CMS
+// ==========================================================================
+//  Copyright (c) Squidex Group
+//  All rights reserved.
+// ==========================================================================
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading.Tasks;
+using Microsoft.AspNetCore.Identity;
+using Squidex.Infrastructure;
+using Squidex.Shared.Users;
+
+// ReSharper disable ImplicitlyCapturedClosure
+// ReSharper disable InvertIf
+// ReSharper disable ReturnTypeCanBeEnumerable.Local
+
+namespace Squidex.Domain.Users
+{
+    public static class UserManagerExtensions
+    {
+        public static Task<IReadOnlyList<IUser>> QueryByEmailAsync(this UserManager<IUser> userManager, string email = null, int take = 10, int skip = 0)
+        {
+            var users = QueryUsers(userManager, email).Skip(skip).Take(take).ToList();
+
+            return Task.FromResult<IReadOnlyList<IUser>>(users);
+        }
+
+        public static Task<long> CountByEmailAsync(this UserManager<IUser> userManager, string email = null)
+        {
+            var count = QueryUsers(userManager, email).LongCount();
+
+            return Task.FromResult(count);
+        }
+
+        private static IQueryable<IUser> QueryUsers(UserManager<IUser> userManager, string email = null)
+        {
+            var result = userManager.Users;
+
+            if (!string.IsNullOrWhiteSpace(email))
+            {
+                var upperEmail = email.ToUpperInvariant();
+
+                result = result.Where(x => x.NormalizedEmail.Contains(upperEmail));
+            }
+
+            return result;
+        }
+
+        public static async Task<IUser> CreateAsync(this UserManager<IUser> userManager, IUserFactory factory, string email, string displayName, string password)
+        {
+            var user = factory.Create(email);
+
+            user.UpdateDisplayName(displayName);
+            user.SetPictureUrlFromGravatar(email);
+
+            await DoChecked(() => userManager.CreateAsync(user), "Cannot create user.");
+
+            if (!string.IsNullOrWhiteSpace(password))
+            {
+                await DoChecked(() => userManager.AddPasswordAsync(user, password), "Cannot create user.");
+            }
+
+            return user;
+        }
+
+        public static async Task UpdateAsync(this UserManager<IUser> userManager, string id, string email, string displayName, string password)
+        {
+            var user = await userManager.FindByIdAsync(id);
+
+            if (user == null)
+            {
+                throw new DomainObjectNotFoundException(id, typeof(IUser));
+            }
+
+            if (!string.IsNullOrWhiteSpace(email))
+            {
+                user.UpdateEmail(email);
+            }
+
+            if (!string.IsNullOrWhiteSpace(displayName))
+            {
+                user.UpdateDisplayName(displayName);
+            }
+
+            await DoChecked(() => userManager.UpdateAsync(user), "Cannot update user.");
+
+            if (!string.IsNullOrWhiteSpace(password))
+            {
+                await DoChecked(() => userManager.RemovePasswordAsync(user), "Cannot update user.");
+                await DoChecked(() => userManager.AddPasswordAsync(user, password), "Cannot update user.");
+            }
+        }
+
+        public static async Task LockAsync(this UserManager<IUser> userManager, string id)
+        {
+            var user = await userManager.FindByIdAsync(id);
+
+            if (user == null)
+            {
+                throw new DomainObjectNotFoundException(id, typeof(IUser));
+            }
+
+            await DoChecked(() => userManager.SetLockoutEndDateAsync(user, DateTimeOffset.UtcNow.AddYears(100)), "Cannot lock user.");
+        }
+
+        public static async Task UnlockAsync(this UserManager<IUser> userManager, string id)
+        {
+            var user = await userManager.FindByIdAsync(id);
+
+            if (user == null)
+            {
+                throw new DomainObjectNotFoundException(id, typeof(IUser));
+            }
+
+            await DoChecked(() => userManager.SetLockoutEndDateAsync(user, null), "Cannot unlock user.");
+        }
+
+        private static async Task DoChecked(Func<Task<IdentityResult>> action, string message)
+        {
+            var result = await action();
+
+            if (!result.Succeeded)
+            {
+                throw new ValidationException(message, result.Errors.Select(x => new ValidationError(x.Description)).ToArray());
+            }
+        }
+    }
+}

src/Squidex.Infrastructure/Assets/ImageInfo.cs

@@ -5,6 +5,7 @@
 //  Copyright (c) Squidex Group
 //  All rights reserved.
 // ==========================================================================
+
 namespace Squidex.Infrastructure.Assets
 {
     public sealed class ImageInfo

src/Squidex.Infrastructure/CQRS/Commands/EntityCreatedResult.cs

@@ -5,6 +5,7 @@
 //  Copyright (c) Squidex Group
 //  All rights reserved.
 // ==========================================================================
+
 namespace Squidex.Infrastructure.CQRS.Commands
 {
     public static class EntityCreatedResult

src/Squidex.Infrastructure/CQRS/Commands/EntityCreatedResult_T.cs

@@ -5,6 +5,7 @@
 //  Copyright (c) Squidex Group
 //  All rights reserved.
 // ==========================================================================
+
 namespace Squidex.Infrastructure.CQRS.Commands
 {
     public sealed class EntityCreatedResult<T> : EntitySavedResult

src/Squidex.Infrastructure/CQRS/Commands/EntitySavedResult.cs

@@ -5,6 +5,7 @@
 //  Copyright (c) Squidex Group
 //  All rights reserved.
 // ==========================================================================
+
 namespace Squidex.Infrastructure.CQRS.Commands
 {
     public class EntitySavedResult

src/Squidex.Infrastructure/CQRS/Commands/ICommand.cs

@@ -5,6 +5,7 @@
 //  Copyright (c) Squidex Group
 //  All rights reserved.
 // ==========================================================================
+
 namespace Squidex.Infrastructure.CQRS.Commands
 {
     public interface ICommand

src/Squidex.Infrastructure/CQRS/Events/CommonHeaders.cs

@@ -5,6 +5,7 @@
 //  Copyright (c) Squidex Group
 //  All rights reserved.
 // ==========================================================================
+
 namespace Squidex.Infrastructure.CQRS.Events
 {
     public static class CommonHeaders

src/Squidex.Infrastructure/CQRS/Events/EnvelopeHeaders.cs

@@ -5,6 +5,7 @@
 //  Copyright (c) Squidex Group
 //  All rights reserved.
 // ==========================================================================
+
 namespace Squidex.Infrastructure.CQRS.Events
 {
     public sealed class EnvelopeHeaders : PropertiesBag

src/Squidex.Infrastructure/CQRS/Events/Envelope_1.cs

@@ -5,6 +5,7 @@
 //  Copyright (c) Squidex Group
 //  All rights reserved.
 // ==========================================================================
+
 namespace Squidex.Infrastructure.CQRS.Events
 {
     public class Envelope<TPayload> where TPayload : class

src/Squidex.Infrastructure/CQRS/Events/IEvent.cs

@@ -5,6 +5,7 @@
 //  Copyright (c) Squidex Group
 //  All rights reserved.
 // ==========================================================================
+
 namespace Squidex.Infrastructure.CQRS.Events
 {
     public interface IEvent

src/Squidex.Infrastructure/CQRS/Events/IEventConsumerInfo.cs

@@ -5,6 +5,7 @@
 //  Copyright (c) Squidex Group
 //  All rights reserved.
 // ==========================================================================
+
 namespace Squidex.Infrastructure.CQRS.Events
 {
     public interface IEventConsumerInfo

src/Squidex.Infrastructure/CQRS/Events/StoredEvent.cs

@@ -5,6 +5,7 @@
 //  Copyright (c) Squidex Group
 //  All rights reserved.
 // ==========================================================================
+
 namespace Squidex.Infrastructure.CQRS.Events
 {
     public sealed class StoredEvent

src/Squidex.Infrastructure/Caching/IInvalidatingCache.cs

@@ -5,6 +5,7 @@
 //  Copyright (c) Squidex Group
 //  All rights reserved.
 // ==========================================================================
+
 namespace Squidex.Infrastructure.Caching
 {
     public interface IInvalidatingCache

src/Squidex.Infrastructure/IExternalSystem.cs

@@ -5,6 +5,7 @@
 //  Copyright (c) Squidex Group
 //  All rights reserved.
 // ==========================================================================
+
 namespace Squidex.Infrastructure
 {
     public interface IExternalSystem

src/Squidex.Infrastructure/Log/ILogAppender.cs

@@ -5,6 +5,7 @@
 //  Copyright (c) Squidex Group
 //  All rights reserved.
 // ==========================================================================
+
 namespace Squidex.Infrastructure.Log
 {
     public interface ILogAppender

src/Squidex.Infrastructure/Log/ILogChannel.cs

@@ -5,6 +5,7 @@
 //  Copyright (c) Squidex Group
 //  All rights reserved.
 // ==========================================================================
+
 namespace Squidex.Infrastructure.Log
 {
     public interface ILogChannel

src/Squidex.Infrastructure/Log/Internal/IConsole.cs

@@ -5,6 +5,7 @@
 //  Copyright (c) Squidex Group
 //  All rights reserved.
 // ==========================================================================
+
 namespace Squidex.Infrastructure.Log.Internal
 {
     public interface IConsole

src/Squidex.Infrastructure/Log/Internal/LogMessageEntry.cs

@@ -5,6 +5,7 @@
 //  Copyright (c) Squidex Group
 //  All rights reserved.
 // ==========================================================================
+
 namespace Squidex.Infrastructure.Log.Internal
 {
     public struct LogMessageEntry

src/Squidex.Infrastructure/Log/SemanticLogLevel.cs

@@ -5,6 +5,7 @@
 //  Copyright (c) Squidex Group
 //  All rights reserved.
 // ==========================================================================
+
 namespace Squidex.Infrastructure.Log
 {
     public enum SemanticLogLevel

src/Squidex.Infrastructure/Reflection/IPropertyAccessor.cs

@@ -5,6 +5,7 @@
 //  Copyright (c) Squidex Group
 //  All rights reserved.
 // ==========================================================================
+
 namespace Squidex.Infrastructure.Reflection
 {
     public interface IPropertyAccessor

src/Squidex.Infrastructure/Security/OpenIdClaims.cs

@@ -5,6 +5,7 @@
 //  Copyright (c) Squidex Group
 //  All rights reserved.
 // ==========================================================================
+
 namespace Squidex.Infrastructure.Security
 {
     public static class OpenIdClaims

src/Squidex.Shared/Identity/SquidexClaimTypes.cs

@@ -0,0 +1,19 @@
+// ==========================================================================
+//  SquidexClaimTypes.cs
+//  Squidex Headless CMS
+// ==========================================================================
+//  Copyright (c) Squidex Group
+//  All rights reserved.
+// ==========================================================================
+
+namespace Squidex.Shared.Identity
+{
+    public static class SquidexClaimTypes
+    {
+        public static readonly string SquidexDisplayName = "urn:squidex:name";
+
+        public static readonly string SquidexPictureUrl = "urn:squidex:picture";
+
+        public static readonly string Prefix = "urn:squidex:";
+    }
+}

src/Squidex.Shared/Identity/SquidexRoles.cs

@@ -0,0 +1,21 @@
+// ==========================================================================
+//  SquidexRoles.cs
+//  Squidex Headless CMS
+// ==========================================================================
+//  Copyright (c) Squidex Group
+//  All rights reserved.
+// ==========================================================================
+
+namespace Squidex.Shared.Identity
+{
+    public static class SquidexRoles
+    {
+        public static readonly string Administrator = "ADMINISTRATOR";
+
+        public static readonly string AppOwner = "APP-OWNER";
+
+        public static readonly string AppEditor = "APP-EDITOR";
+
+        public static readonly string AppDeveloper = "APP-DEVELOPER";
+    }
+}

src/Squidex.Shared/Squidex.Shared.csproj

@@ -0,0 +1,12 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <TargetFramework>netstandard1.6</TargetFramework>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|AnyCPU'">
+    <DebugType>full</DebugType>
+    <DebugSymbols>True</DebugSymbols>
+  </PropertyGroup>
+  <ItemGroup>
+    <PackageReference Include="System.Security.Claims" Version="4.3.0" />
+  </ItemGroup>
+</Project>

src/Squidex.Shared/Users/ExternalLogin.cs

@@ -0,0 +1,32 @@
+// ==========================================================================
+//  ExternalLogin.cs
+//  Squidex Headless CMS
+// ==========================================================================
+//  Copyright (c) Squidex Group
+//  All rights reserved.
+// ==========================================================================
+
+namespace Squidex.Shared.Users
+{
+    public sealed class ExternalLogin
+    {
+        public string LoginProvider { get; }
+
+        public string ProviderKey { get; }
+
+        public string ProviderDisplayName { get; }
+
+        public ExternalLogin(string loginProvider, string providerKey, string providerDisplayName)
+        {
+            LoginProvider = loginProvider;
+
+            ProviderKey = providerKey;
+            ProviderDisplayName = providerDisplayName;
+
+            if (string.IsNullOrWhiteSpace(ProviderDisplayName))
+            {
+                ProviderDisplayName = loginProvider;
+            }
+        }
+    }
+}

src/Squidex.Shared/Users/IUser.cs

@@ -0,0 +1,34 @@
+// ==========================================================================
+//  IUser.cs
+//  Squidex Headless CMS
+// ==========================================================================
+//  Copyright (c) Squidex Group
+//  All rights reserved.
+// ==========================================================================
+
+using System.Collections.Generic;
+using System.Security.Claims;
+
+namespace Squidex.Shared.Users
+{
+    public interface IUser
+    {
+        bool IsLocked { get; }
+
+        string Id { get; }
+
+        string Email { get; }
+
+        string NormalizedEmail { get; }
+
+        IReadOnlyList<Claim> Claims { get; }
+
+        IReadOnlyList<ExternalLogin> Logins { get; }
+
+        void UpdateEmail(string email);
+
+        void AddClaim(Claim claim);
+
+        void SetClaim(string type, string value);
+    }
+}

src/Squidex.Shared/Users/IUserResolver.cs

@@ -0,0 +1,17 @@
+// ==========================================================================
+//  IUserResolver.cs
+//  Squidex Headless CMS
+// ==========================================================================
+//  Copyright (c) Squidex Group
+//  All rights reserved.
+// ==========================================================================
+
+using System.Threading.Tasks;
+
+namespace Squidex.Shared.Users
+{
+    public interface IUserResolver
+    {
+        Task<IUser> FindByIdAsync(string id);
+    }
+}

src/Squidex/Config/Constants.cs

@@ -5,6 +5,7 @@
 //  Copyright (c) Squidex Group
 //  All rights reserved.
 // ==========================================================================
+
 namespace Squidex.Config
 {
     public static class Constants

src/Squidex/Config/Identity/MyIdentityOptions.cs

@@ -5,6 +5,7 @@
 //  Copyright (c) Squidex Group
 //  All rights reserved.
 // ==========================================================================
+
 namespace Squidex.Config.Identity
 {
     public sealed class MyIdentityOptions

src/Squidex/Controllers/Api/Assets/Models/AssetsDto.cs

@@ -5,6 +5,7 @@
 //  Copyright (c) Squidex Group
 //  All rights reserved.
 // ==========================================================================
+
 namespace Squidex.Controllers.Api.Assets.Models
 {
     public sealed class AssetsDto

src/Squidex/Controllers/Api/EventConsumers/Models/EventConsumerDto.cs

@@ -5,6 +5,7 @@
 //  Copyright (c) Squidex Group
 //  All rights reserved.
 // ==========================================================================
+
 namespace Squidex.Controllers.Api.EventConsumers.Models
 {
     public sealed class EventConsumerDto

src/Squidex/Controllers/Api/Plans/Models/PlanDto.cs

@@ -5,6 +5,7 @@
 //  Copyright (c) Squidex Group
 //  All rights reserved.
 // ==========================================================================
+
 namespace Squidex.Controllers.Api.Plans.Models
 {
     public class PlanDto

src/Squidex/Controllers/Api/Statistics/Models/CurrentCallsDto.cs

@@ -5,6 +5,7 @@
 //  Copyright (c) Squidex Group
 //  All rights reserved.
 // ==========================================================================
+
 namespace Squidex.Controllers.Api.Statistics.Models
 {
     public class CurrentCallsDto

src/Squidex/Controllers/Api/Statistics/Models/CurrentStorageDto.cs

@@ -5,6 +5,7 @@
 //  Copyright (c) Squidex Group
 //  All rights reserved.
 // ==========================================================================
+
 namespace Squidex.Controllers.Api.Statistics.Models
 {
     public class CurrentStorageDto

src/Squidex/Controllers/Api/Users/Models/UsersDto.cs

@@ -5,6 +5,7 @@
 //  Copyright (c) Squidex Group
 //  All rights reserved.
 // ==========================================================================
+
 namespace Squidex.Controllers.Api.Users.Models
 {
     public class UsersDto

src/Squidex/Controllers/ContentApi/Models/ContentsDto.cs

@@ -5,6 +5,7 @@
 //  Copyright (c) Squidex Group
 //  All rights reserved.
 // ==========================================================================
+
 namespace Squidex.Controllers.ContentApi.Models
 {
     public class AssetsDto

src/Squidex/Controllers/UI/ExternalProvider.cs

@@ -5,6 +5,7 @@
 //  Copyright (c) Squidex Group
 //  All rights reserved.
 // ==========================================================================
+
 namespace Squidex.Controllers.UI
 {
     public class ExternalProvider

src/Squidex/Pipeline/IAppTrackingWeightFeature.cs

@@ -5,6 +5,7 @@
 //  Copyright (c) Squidex Group
 //  All rights reserved.
 // ==========================================================================
+
 namespace Squidex.Pipeline
 {
     public interface IAppTrackingWeightFeature