.NET 7调用AddToRoleAsync报错：Store未实现IUserRoleStore<TUser>

问题描述 #

调用AddToRoleAsync时触发以下错误：

Store does not implement IUserRoleStore.

使用环境：.NET 7

相关代码 #

SeedUsersAsync 方法 #

public static async Task SeedUsersAsync(UserManager<ApplicationUser> userManager)
{
    if (!userManager.Users.Any())
    {
        var user = new ApplicationUser
        {
            DisplayName = "Bob",
            Email = "bob@test.com",
            UserName = "bob@test.com",
            Address = new Address
            {
                FirstName = "Bob",
                LastName = "Bobbity",
                Street = "10 The street",
                City = "New York",
                State = "NY",
                ZipCode = "90210"
            },
            EmailConfirmed = true,
        };
        await userManager.CreateAsync(user, "Pa$$w0rd");
        await userManager.AddToRoleAsync(user, Roles.Standard.ToString("f")); // 错误发生在此处！
    }
}

IdentityServiceExtensions 代码 #

public static class IdentityServiceExtensions
{
    public static IServiceCollection AddIdentityServices(this IServiceCollection services, IConfiguration config)
    {
        var builder = services.AddIdentityCore<ApplicationUser>();

        builder = new IdentityBuilder(builder.UserType, builder.Services);
        builder.AddEntityFrameworkStores<ShopDbContext>();
        builder.AddSignInManager<SignInManager<ApplicationUser>>();

        builder.Services.AddIdentity<ApplicationUser, ApplicationRole>()
            .AddEntityFrameworkStores<ShopDbContext>();
           

        services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
        .AddJwtBearer(options =>
        {
            options.TokenValidationParameters = new TokenValidationParameters
            {
                ValidateIssuerSigningKey = true,
                IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(config["Token:Key"])),
                ValidIssuer = config["Token:Issuer"],
                ValidateIssuer = true,
                ValidateAudience = false
            };
        });

        
        services.AddAuthorization(opts =>
        {
            opts.AddPolicy(PolicyType.RequireSuperAdminRole.ToString("f"), policy => policy.RequireRole("SuperAdmin"));
            opts.AddPolicy(PolicyType.RequireAdministratorRole.ToString("f"), policy => policy.RequireRole("Admin", "SuperAdmin"));
            opts.AddPolicy(PolicyType.RequireStandardRole.ToString("f"), policy => policy.RequireRole("Basic", "Admin", "SuperAdmin"));
        });

        return services;
    }
}

Program.cs 代码 #

using var scope = app.Services.CreateScope();
var services = scope.ServiceProvider;
var loggerFactory = services.GetRequiredService<ILoggerFactory>();
try
{
    var context = services.GetRequiredService<ShopDbContext>();

    var userManager = services.GetRequiredService<UserManager<ApplicationUser>>();
    var roleManager = services.GetRequiredService<RoleManager<ApplicationRole>>();

    await context.Database.MigrateAsync();
    await ShopContextSeed.SeedAsync(context, loggerFactory);
    await IdentityContextSeed.SeedRolesAsync(roleManager);
    await IdentityContextSeed.SeedUsersAsync(userManager);
}
catch (Exception ex)
{
    var logger = loggerFactory.CreateLogger<Program>();
    logger.LogError(ex, "An error occurred during migration");
}

解决方案 #

错误根源在于Identity服务注册重复且配置冲突：

• 先调用的AddIdentityCore<ApplicationUser>仅提供基础用户管理功能，不包含角色相关的IUserRoleStore实现
• 后续又调用AddIdentity<ApplicationUser, ApplicationRole>，但DI容器中UserManager实例来自第一次不支持角色的配置，导致调用角色操作时出错

方法一：统一使用AddIdentity（推荐） #

修改IdentityServiceExtensions，去掉重复的AddIdentityCore相关代码，直接用AddIdentity完成用户和角色的完整配置：

public static class IdentityServiceExtensions
{
    public static IServiceCollection AddIdentityServices(this IServiceCollection services, IConfiguration config)
    {
        // 直接指定用户和角色类型，自动包含角色相关Store
        services.AddIdentity<ApplicationUser, ApplicationRole>()
            .AddEntityFrameworkStores<ShopDbContext>()
            .AddSignInManager<SignInManager<ApplicationUser>>();

        services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
        .AddJwtBearer(options =>
        {
            options.TokenValidationParameters = new TokenValidationParameters
            {
                ValidateIssuerSigningKey = true,
                IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(config["Token:Key"])),
                ValidIssuer = config["Token:Issuer"],
                ValidateIssuer = true,
                ValidateAudience = false
            };
        });

        services.AddAuthorization(opts =>
        {
            opts.AddPolicy(PolicyType.RequireSuperAdminRole.ToString("f"), policy => policy.RequireRole("SuperAdmin"));
            opts.AddPolicy(PolicyType.RequireAdministratorRole.ToString("f"), policy => policy.RequireRole("Admin", "SuperAdmin"));
            opts.AddPolicy(PolicyType.RequireStandardRole.ToString("f"), policy => policy.RequireRole("Basic", "Admin", "SuperAdmin"));
        });

        return services;
    }
}

方法二：基于AddIdentityCore手动添加角色支持 #

如果坚持使用AddIdentityCore（仅需基础用户功能），需手动补充角色相关服务：

var builder = services.AddIdentityCore<ApplicationUser>();
// 传入用户和角色类型创建IdentityBuilder
builder = new IdentityBuilder(builder.UserType, typeof(ApplicationRole), builder.Services);
builder.AddEntityFrameworkStores<ShopDbContext>();
builder.AddSignInManager<SignInManager<ApplicationUser>>();
// 添加角色管理所需的核心服务
builder.AddRoleManager<RoleManager<ApplicationRole>>();
builder.AddUserRoleStore<UserRoleStore<ApplicationUser, ApplicationRole, ShopDbContext>>();

额外检查项 #

• 确保ShopDbContext继承自IdentityDbContext<ApplicationUser, ApplicationRole, TKey>（例如IdentityDbContext<ApplicationUser, ApplicationRole, int>），让EF正确生成用户角色关联表
• 确认ApplicationRole继承自IdentityRole或IdentityRole<TKey>

内容的提问来源于stack exchange，提问作者x19