Class CheckedMembershipClaimsTransformation

Namespace

Stratara.Identity.AspNetCore.Services

Assembly

Stratara.Identity.AspNetCore.dll

IClaimsTransformation of the kept-and-checked tenant-claim mode: on every request it verifies that the user's membership in the tenant the principal carries is still Active, and removes the tenant claim where it is not.

public sealed class CheckedMembershipClaimsTransformation : IClaimsTransformation

Inheritance

object

CheckedMembershipClaimsTransformation

Implements

IClaimsTransformation

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.ReferenceEquals(object, object)

object.ToString()

Extension Methods

FieldChangedEventExtensions.ApplyPropertyChanged<TAggregate>(TAggregate, FieldChangedEvent<TAggregate>)

EventStream.ApplyEvents(object, IReadOnlyList<IEvent>)

Remarks

Only a principal ASP.NET Identity issued — the one the claims factory stamped, carried by an Identity cookie or bearer token — is checked. A principal of another scheme passes through unchanged: an API key is validated against its own store, and a token your application mints carries the tenant it decided on.

A principal without the tenant claim passes through unchanged: this mode never resolves a tenant per request, so a selection moved elsewhere — by another application sharing the identity store — does not move this sign-in. A removed claim is not replaced by another of the user's tenants; the request resolves as one without a claim does, to the reserved default tenant. A principal carrying the claim whose user id cannot be read loses the claim as well: a membership that cannot be looked up cannot be verified.

The verdict is kept for the request, so a request authenticated more than once looks the membership up once.

Constructors

CheckedMembershipClaimsTransformation(ITenantMembershipStore)

IClaimsTransformation of the kept-and-checked tenant-claim mode: on every request it verifies that the user's membership in the tenant the principal carries is still Active, and removes the tenant claim where it is not.

public CheckedMembershipClaimsTransformation(ITenantMembershipStore membershipStore)

Parameters

membershipStore ITenantMembershipStore

The membership store the carried tenant is checked against.

Remarks

Only a principal ASP.NET Identity issued — the one the claims factory stamped, carried by an Identity cookie or bearer token — is checked. A principal of another scheme passes through unchanged: an API key is validated against its own store, and a token your application mints carries the tenant it decided on.

A principal without the tenant claim passes through unchanged: this mode never resolves a tenant per request, so a selection moved elsewhere — by another application sharing the identity store — does not move this sign-in. A removed claim is not replaced by another of the user's tenants; the request resolves as one without a claim does, to the reserved default tenant. A principal carrying the claim whose user id cannot be read loses the claim as well: a membership that cannot be looked up cannot be verified.

The verdict is kept for the request, so a request authenticated more than once looks the membership up once.

Methods

TransformAsync(ClaimsPrincipal)

Provides a central transformation point to change the specified principal. Note: this will be run on each AuthenticateAsync call, so its safer to return a new ClaimsPrincipal if your transformation is not idempotent.

public Task<ClaimsPrincipal> TransformAsync(ClaimsPrincipal principal)

Parameters

principal ClaimsPrincipal

The ClaimsPrincipal to transform.

Returns

Task<ClaimsPrincipal>

The transformed principal.