Skip to main content
Version: 2026.04.0

Memberships Integration Guide (.NET)

If you want the shortest working path first, start with Verified .NET Quickstart. This guide is the fuller host setup.

Step 1: Install the packages you need​

Core package:

dotnet add package PrimusSaaS.Memberships

ASP.NET Core endpoints:

dotnet add package PrimusSaaS.Memberships.AspNetCore

Durable storage:

dotnet add package PrimusSaaS.Memberships.EFCore

Development and tests only:

dotnet add package PrimusSaaS.Memberships.InMemory

Step 2: Register core and endpoint services​

using PrimusSaaS.Memberships.AspNetCore.DependencyInjection;
using PrimusSaaS.Memberships.DependencyInjection;

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddAuthentication(/* your scheme */);
builder.Services.AddAuthorization();

builder.Services.AddPrimusMemberships(options =>
{
    options.InvitationTtl = TimeSpan.FromDays(7);
    options.RequireMatchingEmailOnAcceptance = true;
    options.AllowBootstrapWithoutInvite = true;
    options.PersistActiveTenantSelection = true;
});

builder.Services.AddPrimusMembershipsAspNetCore(options =>
{
    options.SelfPolicyName = "SelfPolicy";
    options.AdminPolicyName = "TenantAdmin";
});

Step 3: Choose storage​

For development or tests:

builder.Services.AddPrimusMembershipsInMemory();

For durable EF Core storage:

using PrimusSaaS.Memberships.EFCore.DependencyInjection;

builder.Services.AddDbContext<AppDbContext>(options =>
    options.UseSqlServer(builder.Configuration.GetConnectionString("DefaultConnection")));

builder.Services.AddPrimusMembershipsEfCore<AppDbContext>();
protected override void OnModelCreating(ModelBuilder modelBuilder)
{
    modelBuilder.AddPrimusMemberships();
}

Step 4: Map endpoints​

var app = builder.Build();

app.UseAuthentication();
app.UseAuthorization();
app.MapPrimusMembershipEndpoints();

app.Run();

By default, Memberships requires authentication on both self and admin routes. If SelfPolicyName or AdminPolicyName is set, those policies are applied on top of the authenticated-user requirement.

Step 5: Validate your first working flow​

  1. Create an invitation for a tenant.
  2. Accept the invitation with the protected token.
  3. Read /primus/memberships/me/tenants.
  4. Read or set /primus/memberships/me/active-tenant.

Step 6: Add bridges only when needed​

  • Add PrimusSaaS.Memberships.Broker when membership lifecycle events should revoke Identity Broker sessions or refresh tokens.
  • Add PrimusSaaS.Memberships.Rbac when membership lifecycle events should provision RBAC assignments through explicit role mappings.
  • Use the In-Memory or EF Core bridge adapters when Multi-Tenancy or Identity Broker needs membership-backed data.

Use the Composition Guide for the exact bridge expectations and boundaries.