public async Task <UserRoleContainer> EnsureUserRoleContainer(TUser user, CancellationToken cancellationToken)
        {
            cancellationToken.ThrowIfCancellationRequested();
            ThrowIfDisposed();
            var urc          = UserRoleContainer.Create(user.Id);
            var normalizedId = urc.id;

            urc = null;
            try
            {
                urc = await identityDocumentStore.IdentitySession(async session => await session.LoadAsync <UserRoleContainer>(normalizedId, cancellationToken));

                if (urc == null)
                {
                    await identityDocumentStore.IdentitySession(async session => await session.StoreAsync(UserRoleContainer.Create(user.Id), normalizedId, cancellationToken));

                    return(await EnsureUserRoleContainer(user, cancellationToken));
                }
                return(urc);
            }
            catch (Exception e)
            {
                logger.LogError(e, $"error EnsureUserRoleContainer user:{normalizedId} ");
                throw;
            }
        }
        public async Task <IList <string> > GetRolesAsync(TUser user, CancellationToken cancellationToken)
        {
            cancellationToken.ThrowIfCancellationRequested();
            ThrowIfDisposed();
            try
            {
                UserRoleContainer urc = await EnsureUserRoleContainer(user, cancellationToken);

                return(urc.Refs.ToList());
            }
            catch (Exception e)
            {
                logger.LogError(e, $"error GetRolesAsync user:{user} ");
                throw;
            }
        }
        public async Task RemoveFromRoleAsync(TUser user, string roleName, CancellationToken cancellationToken)
        {
            cancellationToken.ThrowIfCancellationRequested();
            ThrowIfDisposed();
            try
            {
                UserRoleContainer urc = await EnsureUserRoleContainer(user, cancellationToken);

                urc = urc.RemoveRefs <UserRoleContainer, string>(roleName);
                await identityDocumentStore.IdentitySession(async s => await s.StoreAsync(urc, urc.id, cancellationToken));
            }
            catch (Exception e)
            {
                logger.LogError(e, $"error AddToRoleAsync user:{user} ");
                throw;
            }
        }