IBeam.AccessControl.Repositories.AzureTable 2.9.0

.NET 10.0 This package targets .NET 10.0. The package is compatible with this framework or higher.
There is a newer version of this package available.
See the version list below for details. 
dotnet add package IBeam.AccessControl.Repositories.AzureTable --version 2.9.0
                    


                    

                
NuGet\Install-Package IBeam.AccessControl.Repositories.AzureTable -Version 2.9.0
This command is intended to be used within the Package Manager Console in Visual Studio, as it uses the NuGet module's version of Install-Package. 
<PackageReference Include="IBeam.AccessControl.Repositories.AzureTable" Version="2.9.0" />
For projects that support PackageReference, copy this XML node into the project file to reference the package. 
<PackageVersion Include="IBeam.AccessControl.Repositories.AzureTable" Version="2.9.0" />
                    


                            Directory.Packages.props
                        

                    

                
<PackageReference Include="IBeam.AccessControl.Repositories.AzureTable" />
                    


                            Project file
For projects that support Central Package Management (CPM), copy this XML node into the solution Directory.Packages.props file to version the package. 
paket add IBeam.AccessControl.Repositories.AzureTable --version 2.9.0
                    


                    

                
#r "nuget: IBeam.AccessControl.Repositories.AzureTable, 2.9.0"
#r directive can be used in F# Interactive and Polyglot Notebooks. Copy this into the interactive tool or source code of the script to reference the package. 
#:package IBeam.AccessControl.Repositories.AzureTable@2.9.0
#:package directive can be used in C# file-based apps starting in .NET 10 preview 4. Copy this into a .cs file before any lines of code to reference the package. 
#addin nuget:?package=IBeam.AccessControl.Repositories.AzureTable&version=2.9.0
                    


                            Install as a Cake Addin
                        

                    

                
#tool nuget:?package=IBeam.AccessControl.Repositories.AzureTable&version=2.9.0
                    


                            Install as a Cake Tool

IBeam.AccessControl.Repositories.AzureTable

IBeam.AccessControl.Repositories.AzureTable provides Azure Table Storage implementations for IBeam access-control resource grants, permission-role maps, and service-operation permission rules.

When To Use This

  • You need persistent access-control rules outside in-memory stores.
  • You want simple Azure Table persistence for tenant-scoped grants and rules.
  • You want permission maps and service-operation rules to survive app restarts.
  • You are not using a custom EF/SQL/application-specific access-control store.

What This Package Contains

Area Type(s) Purpose
Resource grants store AzureTableResourceAccessStore Persists IResourceAccessStore records.
Permission maps store AzureTablePermissionRoleMapStore Persists permission-to-role mappings by name or ID.
Service-operation rules store AzureTableServiceOperationPermissionStore Persists operation allow/deny rules.
Options AzureTableAccessControlOptions Configures connection string, table prefix, table names, and table creation.
DI registration AddIBeamAccessControlAzureTableStores(IConfiguration) Replaces in-memory access-control stores with Azure Table stores.

Architecture Fit

API <-- DTO/model object --> Service <-- Entity --> Repository

This package is a repository layer. It persists access-control data only. It does not evaluate permissions, enforce emergency overrides, or make business decisions.

Quick Start

using IBeam.AccessControl.Repositories.AzureTable;
using IBeam.AccessControl.Services;

builder.Services.AddIBeamAccessControlServices(builder.Configuration);
builder.Services.AddIBeamAccessControlAzureTableStores(builder.Configuration);

Register this package after AddIBeamAccessControlServices so the Azure Table stores replace the default in-memory stores.

Configuration:

{
  "IBeam": {
    "AccessControl": {
      "AzureTable": {
        "StorageConnectionString": "<connection-string>",
        "TablePrefix": "IBeam",
        "ResourceAccessGrantsTableName": "AccessGrants",
        "PermissionRoleMapsTableName": "PermissionRoleMaps",
        "ServiceOperationPermissionsTableName": "ServiceOperationPermissions",
        "CreateTablesIfNotExists": true
      }
    }
  }
}

Configuration

Setting Default Purpose
StorageConnectionString required Azure Storage account connection string.
TablePrefix empty Prefix applied to all table names. Example: IBeam.
ResourceAccessGrantsTableName AccessGrants Logical table name for resource grants.
PermissionRoleMapsTableName PermissionRoleMaps Logical table name for permission-role maps.
ServiceOperationPermissionsTableName ServiceOperationPermissions Logical table name for service-operation allow/deny rules.
CreateTablesIfNotExists true Creates tables automatically on first use. Disable when schema is managed externally.

With the default IBeam prefix, physical tables are:

Logical Purpose Physical Table
Resource grants IBeamAccessGrants
Permission-role maps IBeamPermissionRoleMaps
Service-operation rules IBeamServiceOperationPermissions

Azure Table Schema

IBeamAccessGrants

Purpose: stores tenant-scoped access grants to resources.

Field Purpose
PartitionKey TEN|{tenantId:D}. Queries list grants by tenant.
RowKey AGR|{grantId:D}. Looks up one grant inside a tenant partition.
GrantId Stable grant identifier.
TenantId Tenant that owns the grant.
ResourceType Resource category, such as project or product.
ResourceId Resource identifier, including * for wildcard grants.
SubjectType Subject kind, such as user, api-credential, or agent.
SubjectId User ID, credential ID, agent key, or external subject key.
AccessLevel Granted level such as view, edit, manage, or owner.
Status Grant status, typically active, disabled, or revoked.
CreatedUtc Creation timestamp.
CreatedByUserId Optional administrator/user who created the grant.
UpdatedUtc Optional update timestamp.
ExpiresUtc Optional expiration timestamp.
MetadataJson JSON metadata for application-specific labels/context.

IBeamPermissionRoleMaps

Purpose: stores which roles grant a permission name or permission ID.

Field Purpose
PartitionKey TEN|{tenantId:D}. Queries mappings by tenant.
RowKey NAM|{normalizedPermissionName} for name maps or ID|{permissionId:D} for ID maps.
TenantId Tenant that owns the map.
PermissionName Stable permission key such as pricing.save.
PermissionId Optional stable permission GUID.
RoleNamesCsv Role-name grants for compatibility/display/claim scenarios.
RoleIdsCsv Role-ID grants; preferred for stable authorization.
Status Mapping status, typically active or disabled.
UpdatedUtc Last update timestamp.

IBeamServiceOperationPermissions

Purpose: stores allow/deny rules for service operation names and patterns.

Field Purpose
PartitionKey TEN|{tenantId:D}. Queries rules by tenant.
RowKey SOP|{ruleId:D}. Looks up one service-operation rule.
RuleId Stable rule identifier.
TenantId Tenant that owns the rule.
Pattern Operation pattern, such as pricing.* or coupons.delete.
Effect allow or deny.
SubjectTypesCsv Optional subject filters such as user or agent.
RoleNamesCsv Role names affected by the rule.
RoleIdsCsv Role IDs affected by the rule.
Priority Higher-priority rules win when matching overlaps.
Source Rule source, typically store.
Status Rule status, typically active or disabled.
CreatedUtc Creation timestamp.
UpdatedUtc Last update timestamp.
UpdatedByUserId Optional user/admin who last changed the rule.

Service Operations, Auditing, And Permissions

Repository methods are not service-operation boundaries. The management services that call these stores are tagged in IBeam.AccessControl.Services. Keep authorization and audit behavior in the service layer.

Extension Points

Extension Point Interface Why Replace It
Resource grant storage IResourceAccessStore Use another storage backend.
Permission map storage IPermissionRoleMapStore Use another storage backend.
Operation rule storage IServiceOperationPermissionStore Use another storage backend.
Table naming AzureTableAccessControlOptions Match tenant/company naming conventions.

Extended Docs And Agent Guidance

Troubleshooting

Problem Likely Cause Fix
Startup fails with missing connection string StorageConnectionString was not configured Set IBeam:AccessControl:AzureTable:StorageConnectionString or a supported fallback.
Table creation fails Account permissions or naming invalid Verify storage credentials and alphanumeric table names.
Rules are not found Wrong tenant partition or operation pattern Verify TenantId, PartitionKey, and Pattern.
Role IDs do not match CSV role IDs not populated in mappings/rules Prefer RoleIdsCsv for stable authorization.

Version Notes

  • Targets net10.0.
  • Uses Azure.Data.Tables.
  • Package version is assigned by the repository release workflow.
Product Compatible and additional computed target framework versions.
.NET net10.0 is compatible.  net10.0-android was computed.  net10.0-browser was computed.  net10.0-ios was computed.  net10.0-maccatalyst was computed.  net10.0-macos was computed.  net10.0-tvos was computed.  net10.0-windows was computed. 
Compatible target framework(s)
Included target framework(s) (in package)
Learn more about Target Frameworks and .NET Standard.

NuGet packages (1)

Showing the top 1 NuGet packages that depend on IBeam.AccessControl.Repositories.AzureTable:

Package Downloads
IBeam.Identity.Repositories.AzureTable

IBeam modular framework components for .NET APIs and services.

GitHub repositories

This package is not used by any popular GitHub repositories.

Version Downloads Last Updated
2.9.1 0 7/23/2026
2.9.0 44 7/21/2026
2.8.2 46 7/21/2026
2.8.1 42 7/21/2026
2.8.0 46 7/21/2026
2.7.0 51 7/21/2026