title: Asp.net MVC 5 & Identity / Restricting Data By User / IdentityXXX vs AspNetXXX tables
body: <p>I'm new to MVC 5 and trying to get my head around the new Identity membership system, so forgive my newbie/ignorance on the subject. </p>
  
  <p>My goal... Restrict data sent back to the user to make sure it's the user's data.  I am using Entity Framework and have a set of APIs exposing data for a SPA app.  On top of adding [Authorize] to the APIs, I need to (of course) also make sure the data getting retrieved is only the user's data, e.g. if I have a travel site, I only want to return that user's reservations not all in the system.</p>
  
  <p>What I have done so far... I started a new MVC project so I can use the Identity membership.  Next, I added my existing model and data layers that contain my model for the reservation system.  Success... all working as it should.  In the database, I see all of my travel site tables, a set of AspnetUser tables and a set of Identity tables. Next up, link the reservation entities to the users.  </p>
  
  <p>So, in my model, I create links to what I think is going to be the AspNetUsers entities/tables (as this is where both external and regular users are stored --- for me only external users, fb/google/etc, are stored in the Identity tables) in several of my classes:</p>
  
  <pre><code>public class Reservation() {
  
  ... properties ...      
  
  // Add FK to link reservation to user               
  [ForeignKey("User")]
  public string UserId { get; set; }
  public virtual ApplicationUser User { get; set; }
  
  }
  </code></pre>
  
  <p>... and, I'm using the standard IdentityModel.cs file...</p>
  
  <pre><code>public class ApplicationUser : IdentityUser
  </code></pre>
  
  <p>... but, instead, it's linking to the Identity tables.  So, this does not work...</p>
  
  <pre><code>public IQueryable&lt;Reservation&gt; Reservations()
  {       
          var sUserId = getUserId();  // fctn below       
          _repository.Reservations.Where(r =&gt; r.UserId == sUserId); 
  }
  </code></pre>
  
  <p>This foreign key is linked to the IdentityUser table, not the AspnetUser table.  If the user is a locally registered user, not one using an external login (fb/google/etc), the system only adds the user in the AspnetUser table, not the IdentityUser table.  This means I can't just add the user's Id to the data table because the foreign key isn't valid as the user's Id isn't in the IdentityUser table.  I quickly added this function for testing in my API controller for testing:</p>
  
  <pre><code>private string getUserId() {
      UserManager&lt;ApplicationUser&gt; UserManager = new UserManager&lt;ApplicationUser&gt;(new UserStore&lt;ApplicationUser&gt;(new ApplicationDbContext()));
      if (User.Identity.GetUserId() != null)
      {
          return User.Identity.GetUserId();
      }
      else
      {
          return "";
      }
  }
  </code></pre>
  
  <p>So, my question is what should I be doing here to achieve my desired result of associating data to users?  Should the foreign key/table be to something different?  Am I taking an incorrect approach in adding foreign key relationships back to the user tables?</p>