Class MembershipAuthorizationProvider

Namespace

Stratara.Identity.EntityFrameworkCore

Assembly

Stratara.Identity.EntityFrameworkCore.dll

Membership-backed IAuthorizationProvider: a role check passes when the current session's actor holds the role as a tenant-scoped membership role within the session's data-owner tenant. Use this overload for hosts without a global (ASP.NET Identity) role store; hosts that also gate on global platform roles use MembershipAuthorizationProvider<TUser> instead.

public sealed class MembershipAuthorizationProvider : IAuthorizationProvider

Inheritance

object

MembershipAuthorizationProvider

Implements

IAuthorizationProvider

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.ReferenceEquals(object, object)

object.ToString()

Extension Methods

FieldChangedEventExtensions.ApplyPropertyChanged<TAggregate>(TAggregate, FieldChangedEvent<TAggregate>)

EventStream.ApplyEvents(object, IReadOnlyList<IEvent>)

Remarks

Fail-closed: no ambient session, no membership, a non-active membership, or an unknown role all evaluate to false. A role named in HomeTenantRoles is additionally looked for in the actor's own tenant when that differs from the data owner's; without those options, or without the role named in them, the check resolves in the data-owner tenant alone. Register it as the provider behind the authorizing mediator (for example AddAuthorizingMediator<MembershipAuthorizationProvider>()) or via AddMembershipAuthorization() for hosts that resolve IAuthorizationProvider directly (such as the authorizing outbox dispatcher).

Constructors

MembershipAuthorizationProvider(ISessionContextProvider, ITenantMembershipStore, MembershipAuthorizationOptions?)

Membership-backed IAuthorizationProvider: a role check passes when the current session's actor holds the role as a tenant-scoped membership role within the session's data-owner tenant. Use this overload for hosts without a global (ASP.NET Identity) role store; hosts that also gate on global platform roles use MembershipAuthorizationProvider<TUser> instead.

public MembershipAuthorizationProvider(ISessionContextProvider sessionContextProvider, ITenantMembershipStore membershipStore, MembershipAuthorizationOptions? options = null)

Parameters

sessionContextProvider ISessionContextProvider

Accessor for the ambient session (actor + data-owner tenant).

membershipStore ITenantMembershipStore

The membership store the roles are read from.

options MembershipAuthorizationOptions

The roles that resolve in the actor's own tenant; none when unregistered.

Remarks

Fail-closed: no ambient session, no membership, a non-active membership, or an unknown role all evaluate to false. A role named in HomeTenantRoles is additionally looked for in the actor's own tenant when that differs from the data owner's; without those options, or without the role named in them, the check resolves in the data-owner tenant alone. Register it as the provider behind the authorizing mediator (for example AddAuthorizingMediator<MembershipAuthorizationProvider>()) or via AddMembershipAuthorization() for hosts that resolve IAuthorizationProvider directly (such as the authorizing outbox dispatcher).

Methods

IsInRoleAsync(string, CancellationToken)

Check whether the current caller holds role.

public Task<bool> IsInRoleAsync(string role, CancellationToken cancellationToken = default)

Parameters

role string

The role name to check.

cancellationToken CancellationToken

Propagated by the caller.

Returns

Task<bool>

true if the caller is in the role; false otherwise.