Orleans.Lattice.Membership 9.9.0

Orleans.Lattice.Membership

Optional, opt-in caller-identity resolution add-on for Orleans.Lattice. Resolves who is calling into a LatticeSubject - a stable subject id, the fully transitively-expanded set of group ids, and an optional flat claim bag - so the authorization layer (Orleans.Lattice.Auth) can make an access decision.

Design

AddLatticeMembership() contributes the real credential-resolving context. It selects the first registered ILatticeCredentialAuthenticator that recognizes the ambient LatticeCredential, maps the resulting principal against an introspectable ILatticeMembershipDirectory, and expands group membership to its full transitive closure with cycle detection, so downstream policy always evaluates a flat, uniform group set. Nested (group-in-group) membership is supported, and under the default Union merge mode token-asserted groups are themselves expanded through the directory closure (TokenOnly bypasses the directory, and DirectoryOnly ignores token-asserted groups).

The directory dogfoods reserved sys-membership-* ILattice trees (a groups tree, and an edges tree that stores each membership edge in both directions for forward/reverse scans - there is no separate user record), so every record is readable through the ordinary scan / change-feed surface and every mutation is durably auditable through an auto-enabled per-key history view. Resolution is served from a per-silo cache bounded by the minimum of the configured lifetime and the inbound token's own expiry, and flushed on any sys-membership-* mutation the silo commits, so a membership change is reflected without a process restart (another silo keeps its pre-change entry until that entry expires).

• Opt-in and zero-cost when absent. Core ships only an allow-nothing default membership context that always resolves Anonymous; nothing runs until AddLatticeMembership() is called.
• Extensible authenticators. A built-in JwtCredentialAuthenticator (issuer / audience / signing-key / lifetime validation plus claim-to-subject and claim-to-groups mapping, registered per trusted issuer via AddLatticeJwtAuthenticator) is the base for provider-specific authenticators such as Orleans.Lattice.Membership.Entra; AnonymousCredentialAuthenticator is the fallback default.

Registration

siloBuilder
    .AddLattice((silo, name) => silo.AddMemoryGrainStorage(name))
    .AddLatticeMembership()
    .AddLatticeJwtAuthenticator(options => { /* issuer, audience, signing key */ });

Group-merge policy (Union / TokenOnly / DirectoryOnly), the resolution-cache lifetime, history retention, and an optional claim-to-group projection are configured through LatticeMembershipOptions.

See the Membership documentation for the full guide.