public HttpResponseMessage Post(UserModel user) { // Update Password First Since it can fail. if (!string.IsNullOrEmpty(user.Password)) { try { _userCommandService.ChangePassword(user.Id, user.Password); } catch (PasswordPolicyException policyException) { return(Request.CreateErrorResponse(HttpStatusCode.InternalServerError, string.Join(Environment.NewLine, policyException.Violations))); } } var existingUser = _userQueryService.GetUser(user.Id); var existingRoles = existingUser.Roles.Select(r => r.RoleId).ToList(); _userCommandService.UpdateUser(user); //remove the roles which actually are removed using checkboxes! foreach (var item in user.Roles) { existingRoles.Remove(item.RoleId); } _userCommandService.RevokeRoles(user.Id, existingRoles); _userCommandService.AssignRoles(user.Id, user.Roles.Select(r => r.RoleId).ToList()); // Enable and Disable the user if (user.IsActive != existingUser.IsActive) { if (user.IsActive) { _userCommandService.EnableUser(user.Id); } else { _userCommandService.DisableUser(user.Id); } } // Return "Void" return(Request.CreateResponse(HttpStatusCode.NoContent)); }