Virtual user persisting Roles after logout

Question

I am trying to login a virtual user for my application and have assigned roles to this virtual user.

var virtualUser = Sitecore.Security.Authentication.AuthenticationManager.BuildVirtualUser(userName, true);
Sitecore.Security.Accounts.Role itemRole = Sitecore.Security.Accounts.Role.FromName(role.ToLower());
virtualUser.Roles.Add(itemRole);
Sitecore.Security.Authentication.AuthenticationManager.LoginVirtualUser(virtualUser);

Now I want to logout from this Virtual User so I have used

Sitecore.Security.Authentication.AuthenticationManager.Logout();

It works fine until here.. but when I login to this virtual user again. It persists the roles that were previously assigned to it. how can I remove assigned roles from the virtual user before I log the user out? I have tried removing all roles before logout but that didn't work.

Sitecore.Context.User.Roles.RemoveAll();
Sitecore.Security.Authentication.AuthenticationManager.Logout()

Other approaches I have tried which didn't work.

var virtualuser = Sitecore.Security.Authentication.AuthenticationManager.GetActiveUser();
Sitecore.Security.Authentication.AuthenticationManager.Logout();
virtualUser.Delete();

and

Sitecore.Security.Authentication.AuthenticationManager.Logout();
HttpContext.Current.Session.Abandon();

What should be done to remove roles and logout the virtual user?

Update: I am using extranet\authenticated as the username to login as a virtual user. Could this be causing the issue. Sitecore Version 9.0.2

Answer 1

I was able to achieve this by adding below code.

            var virtualUser = Sitecore.Security.Authentication.AuthenticationManager.GetActiveUser();
            virtualUser.RuntimeSettings.AddedRoles.Clear();
            virtualUser.Roles.RemoveAll();
            virtualUser.RuntimeSettings.Save();
            Sitecore.Security.Authentication.AuthenticationManager.Logout();

Apparently VirtualUser properties and roles are stored in ClientData table which does not clear added roles until you use virtualUser.RuntimeSettings.Save() to update the ClientData table.

Answer 2

Sitecore does not clear virtual users after logout. To over come this, you can remove the virtual user roles before logout

var virtualUser = Sitecore.Security.Authentication.AuthenticationManager.GetActiveUser();

// Remove roles here from virtualUser

Sitecore.Security.Authentication.AuthenticationManager.Logout(); virtualUser.User.Delete();