Class MembershipAuthorizationProvider<TUser>

Namespace

Stratara.Identity.EntityFrameworkCore

Assembly

Stratara.Identity.EntityFrameworkCore.dll

Membership-backed IAuthorizationProvider spanning both role levels: a role check passes when the current session's actor holds the role either as a tenant-scoped membership role within the session's data-owner tenant or as a global ASP.NET Identity role (the platform-role level — platform-administrator, developer and similar roles that are not bound to any tenant).

public sealed class MembershipAuthorizationProvider<TUser> : IAuthorizationProvider where TUser : class

Type Parameters

TUser

The host's ASP.NET Identity user entity.

Inheritance

object

MembershipAuthorizationProvider<TUser>

Implements

IAuthorizationProvider

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.ReferenceEquals(object, object)

object.ToString()

Extension Methods

FieldChangedEventExtensions.ApplyPropertyChanged<TAggregate>(TAggregate, FieldChangedEvent<TAggregate>)

EventStream.ApplyEvents(object, IReadOnlyList<IEvent>)

Remarks

The membership level is consulted first; the global level via UserManager<TUser> only on a membership miss, so tenant-scoped checks incur no Identity-store round trip. Fail-closed: no ambient session or no matching role on either level evaluates to false. The actor's user id is matched against the Identity user's string key (ASP.NET Identity's default keys are GUID strings).

Constructors

MembershipAuthorizationProvider(ISessionContextProvider, ITenantMembershipStore, UserManager<TUser>)

Membership-backed IAuthorizationProvider spanning both role levels: a role check passes when the current session's actor holds the role either as a tenant-scoped membership role within the session's data-owner tenant or as a global ASP.NET Identity role (the platform-role level — platform-administrator, developer and similar roles that are not bound to any tenant).

public MembershipAuthorizationProvider(ISessionContextProvider sessionContextProvider, ITenantMembershipStore membershipStore, UserManager<TUser> userManager)

Parameters

sessionContextProvider ISessionContextProvider

Accessor for the ambient session (actor + data-owner tenant).

membershipStore ITenantMembershipStore

The membership store the tenant-scoped roles are read from.

userManager UserManager<TUser>

The Identity user manager the global roles are read from.

Remarks

The membership level is consulted first; the global level via UserManager<TUser> only on a membership miss, so tenant-scoped checks incur no Identity-store round trip. Fail-closed: no ambient session or no matching role on either level evaluates to false. The actor's user id is matched against the Identity user's string key (ASP.NET Identity's default keys are GUID strings).

Methods

IsInRoleAsync(string, CancellationToken)

Check whether the current caller holds role.

public Task<bool> IsInRoleAsync(string role, CancellationToken cancellationToken = default)

Parameters

role string

The role name to check.

cancellationToken CancellationToken

Propagated by the caller.

Returns

Task<bool>

true if the caller is in the role; false otherwise.