Stratara.Identity.EntityFrameworkCore
4.1.1
Prefix Reserved
See the version list below for details.
dotnet add package Stratara.Identity.EntityFrameworkCore --version 4.1.1
NuGet\Install-Package Stratara.Identity.EntityFrameworkCore -Version 4.1.1
<PackageReference Include="Stratara.Identity.EntityFrameworkCore" Version="4.1.1" />
<PackageVersion Include="Stratara.Identity.EntityFrameworkCore" Version="4.1.1" />
<PackageReference Include="Stratara.Identity.EntityFrameworkCore" />
paket add Stratara.Identity.EntityFrameworkCore --version 4.1.1
#r "nuget: Stratara.Identity.EntityFrameworkCore, 4.1.1"
#:package Stratara.Identity.EntityFrameworkCore@4.1.1
#addin nuget:?package=Stratara.Identity.EntityFrameworkCore&version=4.1.1
#tool nuget:?package=Stratara.Identity.EntityFrameworkCore&version=4.1.1
Stratara.Identity.EntityFrameworkCore
Derived. The behaviour described here is specified under
openspec/specs/. Those specifications are the source; this page explains and illustrates them.
EF Core identity-directory plane for the Stratara stack: user↔tenant membership (many-to-many with tenant-scoped roles), active-tenant selection, and membership-backed authorization.
Contents
IdentityDirectoryDbContext<TContext>— standalone DbContext hosting all four directory tables (tenant_membership,active_tenant,setting_entry,api_key); derive a concrete context and own its migrations. To fold these into an existing context instead, callmodelBuilder.ApplyIdentityDirectoryModel()in itsOnModelCreating.ModelBuilder.ApplyIdentityDirectoryModel()— adds the same tables to an existing context (for example your ASP.NET Identity context) so they share one migration lineage.AddTenantMembershipStore<TContext>()— EF-backedITenantMembershipStore: forward lookup (a user's tenants), reverse lookup (a tenant's members), upsert, GDPR sweeps per user/tenant, and membership-guarded active-tenant switching.MembershipAuthorizationProvider/MembershipAuthorizationProvider<TUser>— the framework's defaultIAuthorizationProvider: role checks pass on tenant-scoped membership roles, theTUservariant additionally on global ASP.NET Identity roles (platform roles).AddMembershipCrossTenantAuthorizer(...)— membership-backedICrossTenantAuthorizerfor strict tenant isolation, with configurable cross-tenant roles for the operator-impersonation path (platform administrators without membership in the target tenant).AddPermissionCatalog(...)+AddCatalogPermissionResolver[<TUser>]()— the application's code-declared permission vocabulary with role grants, resolved from membership roles (and optionally global ASP.NET Identity roles) for[RequirePermission]enforcement and HTTP permission policies.AddApiKeyStore<TContext>()— API keys and personal access tokens:stk_-prefixed 256-bit keys (hash-only storage), fail-closed validation with expiry/revocation, erasure sweeps. Machine keys are materialized as tenant memberships, so they flow through the same role/permission plane as human actors; PATs act as their bound user.ImportAsyncstores a machine key the caller already holds (generated withApiKeyFormat.CreateRawKey()) for setups where the key must exist before boot — idempotent, never mutating an already-stored key.AddSettingCatalog(...)+AddSettingStore<TContext>()— scoped settings plane: code-declaredSettingDefinitions, row-per-key EF storage (setting_entry), a Subject-fedISettingProviderfallback chain (user-in-tenant → user → tenant → global → configuration → default), transparent AES-GCM encryption forIsEncrypteddefinitions, and per-user/per-tenant erasure sweeps.AddTenantMembershipStoreFromContextFactory<TContext>(),AddApiKeyStoreFromContextFactory<TContext>(),AddSettingStoreFromContextFactory<TContext>()— the same three stores, taking a fresh context per operation fromIDbContextFactory<TContext>instead of sharing the request's. See below.
One context for the request, or one per operation
The plain registrations give every directory store in a request the same context instance. A database context serves one operation at a time, so directory work issued concurrently inside one request fails on whichever operation arrives second — at the call site that lost the race, not the one that introduced the concurrency. Sharing also means a store's own commit commits whatever else the consumer has left unsaved on that context.
The …FromContextFactory variants remove both: each operation creates its own context and disposes
it. In exchange, a store write no longer takes part in a transaction the consumer opened on their own
scoped context. That trade is why the shared registration stays the default rather than being
replaced.
They require AddDbContextFactory<TContext>(); a missing registration fails at first resolution.
Keep the factory's options aligned with the scoped registration — interceptors, query filters and
conventions are configured per registration, not per context type. Calling both variants for the same
store leaves whichever ran first in place; they do not compose.
Dependencies
Microsoft.EntityFrameworkCore(+ Relational)Microsoft.Extensions.Identity.CoreStratara.Abstractions
Used together with Stratara.Mediator (authorizing mediator, tenant isolation) and
Stratara.Identity.AspNetCore (sign-in claims bridge).
| Product | Versions Compatible and additional computed target framework versions. |
|---|---|
| .NET | net10.0 is compatible. net10.0-android was computed. net10.0-browser was computed. net10.0-ios was computed. net10.0-maccatalyst was computed. net10.0-macos was computed. net10.0-tvos was computed. net10.0-windows was computed. |
-
net10.0
- Microsoft.EntityFrameworkCore (>= 10.0.11)
- Microsoft.EntityFrameworkCore.Relational (>= 10.0.11)
- Microsoft.Extensions.Configuration.Abstractions (>= 10.0.11)
- Microsoft.Extensions.Identity.Core (>= 10.0.11)
- Microsoft.Extensions.Logging.Abstractions (>= 10.0.11)
- Stratara.Abstractions (>= 4.1.1)
- Stratara.Diagnostics (>= 4.1.1)
NuGet packages
This package is not used by any NuGet packages.
GitHub repositories
This package is not used by any popular GitHub repositories.
| Version | Downloads | Last Updated |
|---|---|---|
| 4.2.0 | 46 | 9/18/2026 |
| 4.1.1 | 61 | 9/16/2026 |
| 4.1.0 | 78 | 9/16/2026 |
| 4.0.4 | 679 | 9/14/2026 |
| 4.0.3 | 112 | 9/3/2026 |
| 4.0.2 | 594 | 9/3/2026 |
| 4.0.1 | 225 | 9/2/2026 |
| 4.0.0 | 615 | 8/31/2026 |
| 4.0.0-preview.1 | 67 | 8/31/2026 |
| 3.4.0 | 135 | 8/28/2026 |
| 3.3.0 | 332 | 8/25/2026 |
| 3.2.3 | 104 | 8/22/2026 |
| 3.2.2 | 729 | 8/14/2026 |
| 3.2.1 | 360 | 8/2/2026 |
| 3.2.0 | 114 | 7/18/2026 |
Correctness fixes for the Orleans execution model ahead of production use. Recorded commands can no longer
reach a bus drain, a durable timer fires once however long its handler runs, and heavy commands are
specified as the exception to the one-writer-per-aggregate promise they always were. The execution-model
reset removes only the host's own checkpoints, and three store-level fixes land for the partition
counter, its backfill and a checkpoint's first write. No schema change; **stop every bus outbox worker
before upgrading hosts that record commands through the execution model**, and register
`AddStrataraIntentStore` on the silos that run the drain.
### Changed
- **Orleans: the execution-model reset removes only the checkpoints of the host's own projections and
sagas.** It removed every checkpoint in the read store, so a reset in one deployment made another
deployment sharing the read store rebuild its projections unasked. The reset now removes the
checkpoints of the projections and sagas registered in the composition it is resolved from, and the
report counts only those. A checkpoint of a projection the host no longer registers stays; nothing
reads it. Resolve the reset from the host's own composition — one that registers no store reader
removes no checkpoint.
- **The documentation states when a read store can be shared.** Checkpoints are keyed by consumer, not
by deployment: deployments sharing a read store need distinct projection names, and at most one of
them runs `AddStrataraSagaGrains`.
- **Orleans: heavy commands are specified as running outside their aggregate's turn and order.** They
always ran in their own bounded pool beside the aggregate's other commands; the specification promised
otherwise. Their hand-over no longer holds the per-aggregate send order either: a command dispatched after
a heavy command for the same aggregate no longer waits for it, and two due heavy commands on one aggregate
no longer hold up the drain's resume pass. Where a heavy command and another command on the same aggregate
both append, the store's version check refuses the later one, which is resumed like any failing command.
- **Orleans: a recorded command is stored under a kind of its own.** No bus outbox drain reads it any more.
Commands recorded under 4.1.0 are still resumed; stop every bus outbox worker before upgrading hosts that
record commands.
### Fixed
- **Orleans: the outbox drain no longer publishes recorded commands to the bus.** It chose between resuming
recorded commands and publishing stored commands by whether the execution model's dispatcher was
registered on its own silo, and the migration guide registers the dispatcher on the API host and the drain
on the silos. Such a silo handed every recorded command — kept ones included — to the bus: commands ran
twice, kept commands came back, the attempt bound did not hold. The drain now resumes recorded commands
wherever an intent store is registered and warns (`117_111`) where recorded commands exist but none is.
Register `AddStrataraIntentStore` on the silos that run the drain.
- **Orleans: a durable timer fires once however long its handler runs.** A handler that outlasted the
reminder call's response timeout was started again by the next tick. A tick that arrives while the same
timer's handler runs now does nothing, and a tick confirms its timer is still registered before firing.
- **Orleans: two writers of the same first checkpoint no longer fail one of them.** When an
activation and its successor overlap during a failover, both can find no checkpoint row and both
insert it; the one that lost to the key threw. It now updates the row the other inserted.
- **Orleans: the partition counter works on a model that does not use snake-case names.** The
interceptor advanced the counter with SQL naming `partition_position` and its columns literally, so
a write context mapping the counter under other names failed every append. It now goes through the
context's model, as the native reader already did.
- **Orleans: the partition-counter backfill positions old entries in the order they were appended.**
It ordered each partition's history by bucket first, so a projection or saga reading across
aggregates saw the facts of one bucket before earlier facts of another. Entries are now positioned
in sequence order, as the event-sourcing-store specification already promised. A store backfilled
under 4.1.0 keeps the positions it was given; the backfill does not reposition entries.