Class MembershipCrossTenantAuthorizer

Namespace

Stratara.Identity.EntityFrameworkCore

Assembly

Stratara.Identity.EntityFrameworkCore.dll

Membership-backed ICrossTenantAuthorizer for strict tenant isolation: a cross-tenant operation (actor tenant ≠ data-owner tenant) is allowed when the actor holds an active membership in the data-owner tenant, or when the actor holds one of the configured CrossTenantRoles (the operator-impersonation path for platform administrators, who typically hold no membership in the tenants they administer).

A configured role is recognised where the actor holds it: in the actor's own membership, or through the registered role checker, which is where a global platform role is found. An actor whose only role level is its membership — a machine actor holds no global roles — therefore passes by a configured role too.

public sealed class MembershipCrossTenantAuthorizer : ICrossTenantAuthorizer

Inheritance

object

MembershipCrossTenantAuthorizer

Implements

ICrossTenantAuthorizer

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.ReferenceEquals(object, object)

object.ToString()

Extension Methods

FieldChangedEventExtensions.ApplyPropertyChanged<TAggregate>(TAggregate, FieldChangedEvent<TAggregate>)

EventStream.ApplyEvents(object, IReadOnlyList<IEvent>)

Remarks

Replaces the framework's deny-all default with stored facts. Register it via AddMembershipCrossTenantAuthorizer(...) alongside AddStrataraTenantIsolation(o => o.Mode = TenantIsolationMode.Strict); without a membership and without a configured role the authorizer stays fail-closed.

Constructors

MembershipCrossTenantAuthorizer(ITenantMembershipStore, IAuthorizationProvider, MembershipCrossTenantAuthorizerOptions)

Membership-backed ICrossTenantAuthorizer for strict tenant isolation: a cross-tenant operation (actor tenant ≠ data-owner tenant) is allowed when the actor holds an active membership in the data-owner tenant, or when the actor holds one of the configured CrossTenantRoles (the operator-impersonation path for platform administrators, who typically hold no membership in the tenants they administer).

A configured role is recognised where the actor holds it: in the actor's own membership, or through the registered role checker, which is where a global platform role is found. An actor whose only role level is its membership — a machine actor holds no global roles — therefore passes by a configured role too.

public MembershipCrossTenantAuthorizer(ITenantMembershipStore membershipStore, IAuthorizationProvider authorizationProvider, MembershipCrossTenantAuthorizerOptions options)

Parameters

membershipStore ITenantMembershipStore

The membership store consulted for the actor's membership in the data-owner tenant.

authorizationProvider IAuthorizationProvider

The role checker consulted for the configured cross-tenant roles.

options MembershipCrossTenantAuthorizerOptions

The configured cross-tenant roles.

Remarks

Replaces the framework's deny-all default with stored facts. Register it via AddMembershipCrossTenantAuthorizer(...) alongside AddStrataraTenantIsolation(o => o.Mode = TenantIsolationMode.Strict); without a membership and without a configured role the authorizer stays fail-closed.

Methods

IsCrossTenantAllowedAsync(SessionContext, CancellationToken)

Decide whether the current principal may operate across tenants for the given session.

public ValueTask<bool> IsCrossTenantAllowedAsync(SessionContext session, CancellationToken cancellationToken = default)

Parameters

session SessionContext

The ambient session whose actor and data-owner tenants diverge.

cancellationToken CancellationToken

Token to observe while authorizing.

Returns

ValueTask<bool>

true to permit the cross-tenant operation; false to reject it.