ServiceStack caching users roles and permissions approach - servicestack

Question

With the AuthFeature / AuthUserSession plugin, we can populate the session with a users roles, permissions, etc in the PopulateSessionFilter on each request.
Plugins.Add(new AuthFeature(() => new AuthUserSession(),
new IAuthProvider[] {
new CredentialsAuthProvider(AppSettings),
new NetCoreIdentityAuthProvider(AppSettings)
{
PopulateSessionFilter = (session, principal, req) =>
{
//Example of populating ServiceStack Session Roles for EF Identity DB
var userManager = req.TryResolve<UserManager<ApplicationUser>>();
var user = userManager.FindByIdAsync(session.Id).Result;
var roles = userManager.GetRolesAsync(user).Result;
session.Roles = roles.ToList();
}
},
}));
Is there way to store this in cache, MemoryCacheClient or Redis depending on what has been configured so do not have to do a database call here, or is it a case of implementing the caching solution in the userManager itself (or whatever repository code is written to get this information)?

Answer 1

I've included better support for accessing and caching ASP.NET Identity User Roles in this commit. This change is available in the latest v5.4.1 pre-release that's now on MyGet.
var userManager = req.TryResolve<UserManager<ApplicationUser>>();
var user = userManager.FindByIdAsync(session.Id).Result;
var roles = userManager.GetRolesAsync(user).Result;
Whilst this works it uses "sync over async" which is discouraged as it's problematic in many use-cases, less efficient than sync and the limited API forces multiple DB calls.
The new IDbConnection.GetIdentityUserRolesById(userId) API is now our recommended and more efficient API which resolves the above issues and utilizes a single DB call to fetch just the ASP.NET Identity User Roles.
This is an extension method that works on any IDbConnection, to avoid opening a new DB Connection from the connection string yourself you can utilize EF's ApplicationDbContext DB Connection in a new scope by adding this to your App:
public static class AppExtensions
{
public static T DbExec<T>(this IServiceProvider services, Func<IDbConnection, T> fn) =>
services.DbContextExec<ApplicationDbContext,T>(ctx => {
ctx.Database.OpenConnection(); return ctx.Database.GetDbConnection(); }, fn);
}
This provides a generic API that makes it easy to utilize your App context DB connection.
With this you can fetch the User Roles with the more terse and efficient alternative:
new NetCoreIdentityAuthProvider(AppSettings)
{
PopulateSessionFilter = (session, principal, req) =>
{
session.Roles = ApplicationServices.DbExec(db => db.GetIdentityUserRolesById(session.Id));
}
},
To avoid hitting the DB on each request you can cache the results by utilizing the local Memory Cache Client with:
new NetCoreIdentityAuthProvider(AppSettings)
{
PopulateSessionFilter = (session, principal, req) =>
{
session.Roles = req.GetMemoryCacheClient().GetOrCreate(
IdUtils.CreateUrn(nameof(session.Roles), session.Id),
TimeSpan.FromMinutes(20),
() => ApplicationServices.DbExec(db => db.GetIdentityUserRolesById(session.Id)));
}
},
This will avoid hitting the database to fetch User Roles for this user for 20 minutes.
The above utilizes the MemoryCacheClient which avoids any I/O as it's maintained in memory, to utilize the Registered ICacheClient instead, rename GetMemoryCacheClient() to GetCacheClient(), i.e:
new NetCoreIdentityAuthProvider(AppSettings)
{
PopulateSessionFilter = (session, principal, req) =>
{
session.Roles = req.GetCacheClient().GetOrCreate(
IdUtils.CreateUrn(nameof(session.Roles), session.Id),
TimeSpan.FromMinutes(20),
() => ApplicationServices.DbExec(db => db.GetIdentityUserRolesById(session.Id)));
}
},