ScratchTenantMarker
Namespace: Meshmakers.Octo.Communication.Contracts.DataTransferObjects
Record of a scratch tenant: a child tenant created with the opt-in flag scratch by a
client-credentials client of its direct parent. It names the creator, so identity can give exactly that
client's mirror the TenantOwners group in the child, and so the grant can be revoked for good.
public class ScratchTenantMarker
Inheritance Object → ScratchTenantMarker
Remarks:
Persisted as JSON in the configuration of the system tenant, keyed by the child tenant id (see ScratchTenantMarker.GetConfigurationKey(String)). It deliberately does not live in the child's own database: it has to exist before the child does (identity sets the child up the moment it is created), it must not be carried along by a dump, and it must survive the restore that drops and re-creates the child.
Written by the asset repository (create); read, granted and revoked by identity; removed with the tenant. A record is only honoured while ScratchTenantMarker.ParentTenantId is the tenant's actual parent.
Fields
ConfigurationKeyPrefix
Prefix of the system-tenant configuration key.
public static string ConfigurationKeyPrefix;
Properties
ParentTenantId
The direct parent tenant the creator client authenticated in when it created the tenant.
public string ParentTenantId { get; set; }
Property Value
CreatorClientId
Client id of the creator (the client_id claim of its token).
public string CreatorClientId { get; set; }
Property Value
CreatedAtUtc
When the tenant was created as a scratch tenant.
public DateTime CreatedAtUtc { get; set; }
Property Value
GrantedAtUtc
When identity first granted TenantOwners to the creator's mirror; null until then.
public Nullable<DateTime> GrantedAtUtc { get; set; }
Property Value
RevokedAtUtc
When the grant was revoked; null while it is in force. A revoked marker is never granted again, however often the tenant is set up or the mirror re-provisioned.
public Nullable<DateTime> RevokedAtUtc { get; set; }
Property Value
RevokedBy
Who revoked the grant (user name or client id), for the audit trail.
public string RevokedBy { get; set; }
Property Value
Constructors
ScratchTenantMarker()
public ScratchTenantMarker()
Methods
GetConfigurationKey(String)
The system-tenant configuration key of the marker of tenantId.
public static string GetConfigurationKey(string tenantId)
Parameters
tenantId String
Returns
TryCreateForCaller(ClaimsPrincipal, String, out ScratchTenantMarker)
Decides whether user may create a scratch tenant whose direct parent is
parentTenantId and builds the marker. Returns the reason in words when it may not,
null when it may. The scratch grant is for agents, so the token must be a client-credentials token
(no user), issued for the parent tenant itself, and name its client. The role TenantManagement is
checked by the endpoint's own policy, not here.
public static string TryCreateForCaller(ClaimsPrincipal user, string parentTenantId, out ScratchTenantMarker marker)
Parameters
user ClaimsPrincipal
The caller's principal.
parentTenantId String
The tenant that becomes (or is) the direct parent of the scratch tenant.
marker ScratchTenantMarker
The marker to record when the caller may; null otherwise.