Stratara.Identity.EntityFrameworkCore
4.0.3
Prefix Reserved
See the version list below for details.
dotnet add package Stratara.Identity.EntityFrameworkCore --version 4.0.3
NuGet\Install-Package Stratara.Identity.EntityFrameworkCore -Version 4.0.3
<PackageReference Include="Stratara.Identity.EntityFrameworkCore" Version="4.0.3" />
<PackageVersion Include="Stratara.Identity.EntityFrameworkCore" Version="4.0.3" />
<PackageReference Include="Stratara.Identity.EntityFrameworkCore" />
paket add Stratara.Identity.EntityFrameworkCore --version 4.0.3
#r "nuget: Stratara.Identity.EntityFrameworkCore, 4.0.3"
#:package Stratara.Identity.EntityFrameworkCore@4.0.3
#addin nuget:?package=Stratara.Identity.EntityFrameworkCore&version=4.0.3
#tool nuget:?package=Stratara.Identity.EntityFrameworkCore&version=4.0.3
Stratara.Identity.EntityFrameworkCore
Derived. The behaviour described here is specified under
openspec/specs/. Those specifications are the source; this page explains and illustrates them.
EF Core identity-directory plane for the Stratara stack: user↔tenant membership (many-to-many with tenant-scoped roles), active-tenant selection, and membership-backed authorization.
Contents
IdentityDirectoryDbContext<TContext>— standalone DbContext hosting all four directory tables (tenant_membership,active_tenant,setting_entry,api_key); derive a concrete context and own its migrations. To fold these into an existing context instead, callmodelBuilder.ApplyIdentityDirectoryModel()in itsOnModelCreating.ModelBuilder.ApplyIdentityDirectoryModel()— adds the same tables to an existing context (for example your ASP.NET Identity context) so they share one migration lineage.AddTenantMembershipStore<TContext>()— EF-backedITenantMembershipStore: forward lookup (a user's tenants), reverse lookup (a tenant's members), upsert, GDPR sweeps per user/tenant, and membership-guarded active-tenant switching.MembershipAuthorizationProvider/MembershipAuthorizationProvider<TUser>— the framework's defaultIAuthorizationProvider: role checks pass on tenant-scoped membership roles, theTUservariant additionally on global ASP.NET Identity roles (platform roles).AddMembershipCrossTenantAuthorizer(...)— membership-backedICrossTenantAuthorizerfor strict tenant isolation, with configurable cross-tenant roles for the operator-impersonation path (platform administrators without membership in the target tenant).AddPermissionCatalog(...)+AddCatalogPermissionResolver[<TUser>]()— the application's code-declared permission vocabulary with role grants, resolved from membership roles (and optionally global ASP.NET Identity roles) for[RequirePermission]enforcement and HTTP permission policies.AddApiKeyStore<TContext>()— API keys and personal access tokens:stk_-prefixed 256-bit keys (hash-only storage), fail-closed validation with expiry/revocation, erasure sweeps. Machine keys are materialized as tenant memberships, so they flow through the same role/permission plane as human actors; PATs act as their bound user.ImportAsyncstores a machine key the caller already holds (generated withApiKeyFormat.CreateRawKey()) for setups where the key must exist before boot — idempotent, never mutating an already-stored key.AddSettingCatalog(...)+AddSettingStore<TContext>()— scoped settings plane: code-declaredSettingDefinitions, row-per-key EF storage (setting_entry), a Subject-fedISettingProviderfallback chain (user-in-tenant → user → tenant → global → configuration → default), transparent AES-GCM encryption forIsEncrypteddefinitions, and per-user/per-tenant erasure sweeps.AddTenantMembershipStoreFromContextFactory<TContext>(),AddApiKeyStoreFromContextFactory<TContext>(),AddSettingStoreFromContextFactory<TContext>()— the same three stores, taking a fresh context per operation fromIDbContextFactory<TContext>instead of sharing the request's. See below.
One context for the request, or one per operation
The plain registrations give every directory store in a request the same context instance. A database context serves one operation at a time, so directory work issued concurrently inside one request fails on whichever operation arrives second — at the call site that lost the race, not the one that introduced the concurrency. Sharing also means a store's own commit commits whatever else the consumer has left unsaved on that context.
The …FromContextFactory variants remove both: each operation creates its own context and disposes
it. In exchange, a store write no longer takes part in a transaction the consumer opened on their own
scoped context. That trade is why the shared registration stays the default rather than being
replaced.
They require AddDbContextFactory<TContext>(); a missing registration fails at first resolution.
Keep the factory's options aligned with the scoped registration — interceptors, query filters and
conventions are configured per registration, not per context type. Calling both variants for the same
store leaves whichever ran first in place; they do not compose.
Dependencies
Microsoft.EntityFrameworkCore(+ Relational)Microsoft.Extensions.Identity.CoreStratara.Abstractions
Used together with Stratara.Mediator (authorizing mediator, tenant isolation) and
Stratara.Identity.AspNetCore (sign-in claims bridge).
| Product | Versions Compatible and additional computed target framework versions. |
|---|---|
| .NET | net10.0 is compatible. net10.0-android was computed. net10.0-browser was computed. net10.0-ios was computed. net10.0-maccatalyst was computed. net10.0-macos was computed. net10.0-tvos was computed. net10.0-windows was computed. |
-
net10.0
- Microsoft.EntityFrameworkCore (>= 10.0.11)
- Microsoft.EntityFrameworkCore.Relational (>= 10.0.11)
- Microsoft.Extensions.Configuration.Abstractions (>= 10.0.11)
- Microsoft.Extensions.Identity.Core (>= 10.0.11)
- Microsoft.Extensions.Logging.Abstractions (>= 10.0.11)
- Stratara.Abstractions (>= 4.0.3)
- Stratara.Diagnostics (>= 4.0.3)
NuGet packages
This package is not used by any NuGet packages.
GitHub repositories
This package is not used by any popular GitHub repositories.
| Version | Downloads | Last Updated |
|---|---|---|
| 4.2.0 | 37 | 9/18/2026 |
| 4.1.1 | 58 | 9/16/2026 |
| 4.1.0 | 73 | 9/16/2026 |
| 4.0.4 | 590 | 9/14/2026 |
| 4.0.3 | 111 | 9/3/2026 |
| 4.0.2 | 591 | 9/3/2026 |
| 4.0.1 | 200 | 9/2/2026 |
| 4.0.0 | 596 | 8/31/2026 |
| 4.0.0-preview.1 | 66 | 8/31/2026 |
| 3.4.0 | 134 | 8/28/2026 |
| 3.3.0 | 331 | 8/25/2026 |
| 3.2.3 | 104 | 8/22/2026 |
| 3.2.2 | 728 | 8/14/2026 |
| 3.2.1 | 358 | 8/2/2026 |
| 3.2.0 | 112 | 7/18/2026 |
Three fixes to the same complaint: a host composed exactly as the documentation describes did not
start. Each one was a registration the composites assumed somebody else had made — a tracer, a unit
of work, a Redis connection — and each is now made by the registration that needs it. Nothing that
already worked changes: every fix defers to a registration the host makes itself, in either order,
so the lines a working host added to get past these gaps can simply be deleted. Additive on every
published surface.
### Fixed
- **A host without Redis starts and dispatches.** Every composite that carries a dispatcher
registered the projection-replay state, and its only implementation took a Redis connection that
no composite registers, so a host composed as documented failed at its first dispatch unless it
also ran Redis and called `AddCaching()`. `AddProjectionReplayState()` now chooses at first
resolution: with a registered `IConnectionMultiplexer` the Redis-backed state as before, without
one an in-process state with the same lease semantics — and a warning, once at start-up
(`104_012`), that replay coordination is confined to that process, so a replay requested there
suppresses publication there only. A deployment whose replay must reach several hosts registers
the shared connection, in either order. Redis-backed hosts observe no change.
- **Registering a store context now registers its unit of work.**
`AddNpgsqlWriteDbContextFactory<T>()` registered the context factory, the context and the default
connection resolver but not the `IWriteUnitOfWork` that the event source, the outbox dispatcher and
the command worker take from the container — and nothing else in the published packages did, so a
host composed exactly as documented failed at its first command with a dependency-injection error.
The write registration now try-adds a scoped `IWriteUnitOfWork` over its context, and
`AddNpgsqlReadDbContextFactory<T>()` try-adds `IProjectionsUnitOfWork` and `IReadUnitOfWork`
likewise. A unit of work the host registers itself, before or after, is still the one used; a
hand-written registration can simply be deleted.
- **`AddMediator()` no longer requires the host to register an OpenTelemetry `Tracer`.** The
mediator traces every dispatch and obtained its tracer from the host, but nothing registered one,
so a host that called `AddMediator()` and nothing else failed at the first resolve of `IMediator`.
`AddMediator()` now registers a fallback that emits the dispatch spans from the framework's
`Stratara.Application` activity source — a host that subscribes to framework telemetry sees them,
a host that subscribes to nothing pays for nothing. A `Tracer` the host registers, before or after
`AddMediator()`, is still the one used, so no existing host changes behaviour; the registration
line can simply be deleted. The samples, the README and the package README no longer carry it.