If the user has already been acquired, or set explicitly in the User property, the method returns immediately. Otherwise, it redirects to the Veriplace server to begin a user discovery transaction. If the server can detect the current user without interaction, it redirects immediately back to your application; otherwise it prompts the user to log in (unless you have disabled this by setting UserInteractionAllowed to false) and redirects back once they have done so.

When your application receives the callback, it will be to the same URL and with the same HTTP parameters as the initial request, but with an additional token to indicate that the user is now available. You do not need to check for this token; just call RequireUser(state) as you did before, and this time the method will return normally.