Stratara.Identity.EntityFrameworkCore
4.3.1
Prefix Reserved
dotnet add package Stratara.Identity.EntityFrameworkCore --version 4.3.1
NuGet\Install-Package Stratara.Identity.EntityFrameworkCore -Version 4.3.1
<PackageReference Include="Stratara.Identity.EntityFrameworkCore" Version="4.3.1" />
<PackageVersion Include="Stratara.Identity.EntityFrameworkCore" Version="4.3.1" />
<PackageReference Include="Stratara.Identity.EntityFrameworkCore" />
paket add Stratara.Identity.EntityFrameworkCore --version 4.3.1
#r "nuget: Stratara.Identity.EntityFrameworkCore, 4.3.1"
#:package Stratara.Identity.EntityFrameworkCore@4.3.1
#addin nuget:?package=Stratara.Identity.EntityFrameworkCore&version=4.3.1
#tool nuget:?package=Stratara.Identity.EntityFrameworkCore&version=4.3.1
Stratara.Identity.EntityFrameworkCore
Derived. The behaviour described here is specified under
openspec/specs/. Those specifications are the source; this page explains and illustrates them.
EF Core identity-directory plane for the Stratara stack: user↔tenant membership (many-to-many with tenant-scoped roles), active-tenant selection, and membership-backed authorization.
Contents
IdentityDirectoryDbContext<TContext>— standalone DbContext hosting all four directory tables (tenant_membership,active_tenant,setting_entry,api_key); derive a concrete context and own its migrations. To fold these into an existing context instead, callmodelBuilder.ApplyIdentityDirectoryModel()in itsOnModelCreating.ModelBuilder.ApplyIdentityDirectoryModel()— adds the same tables to an existing context (for example your ASP.NET Identity context) so they share one migration lineage.AddTenantMembershipStore<TContext>()— EF-backedITenantMembershipStore: forward lookup (a user's tenants), reverse lookup (a tenant's members), upsert, GDPR sweeps per user/tenant, and membership-guarded active-tenant switching.MembershipAuthorizationProvider/MembershipAuthorizationProvider<TUser>— the framework's defaultIAuthorizationProvider: role checks pass on tenant-scoped membership roles, theTUservariant additionally on global ASP.NET Identity roles (platform roles).AddMembershipCrossTenantAuthorizer(...)— membership-backedICrossTenantAuthorizerfor strict tenant isolation, with configurable cross-tenant roles for the operator-impersonation path (platform administrators without membership in the target tenant).AddPermissionCatalog(...)+AddCatalogPermissionResolver[<TUser>]()— the application's code-declared permission vocabulary with role grants, resolved from membership roles (and optionally global ASP.NET Identity roles) for[RequirePermission]enforcement and HTTP permission policies.AddApiKeyStore<TContext>()— API keys and personal access tokens:stk_-prefixed 256-bit keys (hash-only storage), fail-closed validation with expiry/revocation, erasure sweeps. Machine keys are materialized as tenant memberships, so they flow through the same role/permission plane as human actors; PATs act as their bound user.ImportAsyncstores a machine key the caller already holds (generated withApiKeyFormat.CreateRawKey()) for setups where the key must exist before boot — idempotent, never mutating an already-stored key.AddSettingCatalog(...)+AddSettingStore<TContext>()— scoped settings plane: code-declaredSettingDefinitions, row-per-key EF storage (setting_entry), a Subject-fedISettingProviderfallback chain (user-in-tenant → user → tenant → global → configuration → default), transparent AES-GCM encryption forIsEncrypteddefinitions, and per-user/per-tenant erasure sweeps.AddTenantMembershipStoreFromContextFactory<TContext>(),AddApiKeyStoreFromContextFactory<TContext>(),AddSettingStoreFromContextFactory<TContext>()— the same three stores, taking a fresh context per operation fromIDbContextFactory<TContext>instead of sharing the request's. See below.
One context for the request, or one per operation
The plain registrations give every directory store in a request the same context instance. A database context serves one operation at a time, so directory work issued concurrently inside one request fails on whichever operation arrives second — at the call site that lost the race, not the one that introduced the concurrency. Sharing also means a store's own commit commits whatever else the consumer has left unsaved on that context.
The …FromContextFactory variants remove both: each operation creates its own context and disposes
it. In exchange, a store write no longer takes part in a transaction the consumer opened on their own
scoped context. That trade is why the shared registration stays the default rather than being
replaced.
They require AddDbContextFactory<TContext>(); a missing registration fails at first resolution.
Keep the factory's options aligned with the scoped registration — interceptors, query filters and
conventions are configured per registration, not per context type. Calling both variants for the same
store leaves whichever ran first in place; they do not compose.
Dependencies
Microsoft.EntityFrameworkCore(+ Relational)Microsoft.Extensions.Identity.CoreStratara.Abstractions
Used together with Stratara.Mediator (authorizing mediator, tenant isolation) and
Stratara.Identity.AspNetCore (sign-in claims bridge).
| Product | Versions Compatible and additional computed target framework versions. |
|---|---|
| .NET | net10.0 is compatible. net10.0-android was computed. net10.0-browser was computed. net10.0-ios was computed. net10.0-maccatalyst was computed. net10.0-macos was computed. net10.0-tvos was computed. net10.0-windows was computed. |
-
net10.0
- Microsoft.EntityFrameworkCore (>= 10.0.11)
- Microsoft.EntityFrameworkCore.Relational (>= 10.0.11)
- Microsoft.Extensions.Configuration.Abstractions (>= 10.0.11)
- Microsoft.Extensions.Identity.Core (>= 10.0.11)
- Microsoft.Extensions.Logging.Abstractions (>= 10.0.11)
- Stratara.Abstractions (>= 4.3.1)
- Stratara.Diagnostics (>= 4.3.1)
NuGet packages
This package is not used by any NuGet packages.
GitHub repositories
This package is not used by any popular GitHub repositories.
| Version | Downloads | Last Updated |
|---|---|---|
| 4.3.1 | 35 | 9/25/2026 |
| 4.3.0 | 324 | 9/23/2026 |
| 4.2.0 | 136 | 9/18/2026 |
| 4.1.1 | 75 | 9/16/2026 |
| 4.1.0 | 91 | 9/16/2026 |
| 4.0.4 | 900 | 9/14/2026 |
| 4.0.3 | 114 | 9/3/2026 |
| 4.0.2 | 595 | 9/3/2026 |
| 4.0.1 | 241 | 9/2/2026 |
| 4.0.0 | 639 | 8/31/2026 |
| 4.0.0-preview.1 | 68 | 8/31/2026 |
| 3.4.0 | 139 | 8/28/2026 |
| 3.3.0 | 333 | 8/25/2026 |
| 3.2.3 | 105 | 8/22/2026 |
| 3.2.2 | 730 | 8/14/2026 |
| 3.2.1 | 361 | 8/2/2026 |
| 3.2.0 | 115 | 7/18/2026 |
A correctness release. A projection replay could apply a stream's later fact before its first and
then fail on every attempt, leaving the read models it had emptied empty; the two backfills that
prepare existing history for the Orleans execution model's commit-order readers took the same wrong
order. Beyond that, the setting store no longer needs declared settings, and a setting or permission
vocabulary can be declared in parts.
**Upgrading:**
- **If you replay projections, upgrade.** A store in which one save appended several versions of a
stream can hold sequence numbers that run against those versions, and a replay over it could not
complete. No entry is rewritten and no migration is needed.
- **If you implement `IEventStreamRepository` yourself,** override
`GetManyAfterSequenceInStreamOrderAsync` to give your replay the same guarantee; the default keeps
sequence order.
- **If you backfilled a store for a commit-order reader before this release,** the Orleans migration
guide gives the query that tells whether that history holds a stream out of version order, and how
to repair it.
- **A host that declared an empty `SettingCatalog` as a workaround can drop it.** A host that
registers a catalog through a factory and then calls `AddSettingCatalog` or `AddPermissionCatalog`
now fails at registration instead of replacing that catalog.
- No schema change.
### Added
- **`IEventStreamRepository.GetManyAfterSequenceInStreamOrderAsync`**: a range of the store in the order a
replay applies it — each stream's entries in version order, the streams interleaved as their sequence numbers
interleave them, and the range extended until it no longer ends between two versions of one stream. The default
implementation returns `GetManyAfterSequenceAsync`, sequence order, so a repository of your own compiles and
behaves as before; override the member to give your replay the guarantee.
### Fixed
- **A projection replay applies each stream in version order.** A save does not number its entries in version
order — EF Core chooses the statement order and the identity column numbers the rows as they arrive — and the
replay walked the store by sequence number, so it met a stream's later fact before its first. A projection that
reports a missing preceding fact then failed the batch on every attempt, and because a replay empties the read
models first, each attempt left the read side empty. On a store where many saves wrote several versions of one
stream, no replay could complete. The replay now reads through the new repository member; a batch can hold more
entries than `Projections:BatchSize`. No entry is rewritten and no migration is needed.
- **Both commit-order backfills keep each stream in version order.** `CommitTransactionIdBackfill` could end a
batch between two versions of one stream, stamping the later one with the earlier transaction.
`PartitionCounterBackfill` handed out positions in sequence order, so every save it positioned that the store
had numbered against its versions was read inverted by the portable reader. Both now extend a batch until it no
longer ends inside a stream, and the portable backfill positions each stream's entries in version order.
History backfilled with an earlier version is not revisited, because checkpoints stand on its commit records and
positions; the Orleans migration guide gives the query that tells whether a store holds such a stream.
- **The setting store works without declared settings.** `AddSettingStore<TContext>()` and
`AddSettingStoreFromContextFactory<TContext>()` resolved the `SettingCatalog` inside a factory, so a
host that registered the store and `AddStrataraErasure()` but declared no settings built, passed
`ValidateOnBuild` and every start-up check, and failed on its first erasure with *No service for type
`SettingCatalog` has been registered*. The store now registers an empty catalog when none is declared:
the store works, erasure included, and reading any setting through `ISettingProvider` fails as
undeclared. The example on `AddStrataraErasure` was exactly that composition. A host that declared an
empty catalog as a workaround can drop it.
- **A second `AddSettingCatalog` or `AddPermissionCatalog` call no longer replaces the first.** Each
call registered a new catalog and the last one won, so a host declaring its vocabulary per module kept
only the last module's — the others' settings failed as undeclared and their permissions were denied
without a word. Every call now adds to the one registered catalog, in whichever order it runs relative
to the setting store. A setting name declared in two parts throws as a duplicate; a redeclared
permission has no effect and grants to one role accumulate. A catalog registered as a factory cannot be
added to, and the next call now throws `InvalidOperationException` saying so instead of replacing it.