Skip to content

Commit 2f10211

Browse files
mythzmythz
committed
Add new v5.7 Release blog posts
1 parent d82e551 commit 2f10211

26 files changed

+761
-0
lines changed

‎MyApp/_posts/2025-04-15_identityauth-claims-roles.md

+98
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
---
2+
title: Complete Admin UI Management for Identity Claims and Roles
3+
summary: With support for adding Roles and User and Role Claims, the built-in Admin UI now offers complete Identity Auth management
4+
tags: [identity-auth,admin-ui,auth]
5+
author: Demis Bellot
6+
image: https://images.unsplash.com/photo-1590856029826-c7a73142bbf1?crop=entropy&fit=crop&h=1000&w=2000
7+
---
8+
9+
The latest ServiceStack v8.7 Release completes our transition to [ASP .NET Core Identity Auth](https://docs.servicestack.net/auth/identity-auth)
10+
with management APIs and Admin UIs for managing Identity Auth Roles and Claims for both Users and Roles.
11+
12+
All ServiceStack Apps now includes a complete IdentityAuth Management Admin UI which can Add/Remove Roles from the
13+
new Identity **Roles** Admin UI:
14+
15+
![](/img/posts/identityauth-claims-roles/identityauth-roles.webp)
16+
17+
If your App uses an extended `IdentityRole` data model, it can be configured with:
18+
19+
```csharp
20+
services.AddPlugin(
21+
new AuthFeature(IdentityAuth.For<ApplicationUser,ApplicationRole>(...)));
22+
```
23+
24+
If it's also configured to use a different `PrimaryKey` type, it can be configured with:
25+
26+
```csharp
27+
services.AddPlugin(
28+
new AuthFeature(IdentityAuth.For<AppUser,AppRole,int>(...)));
29+
```
30+
31+
### IdentityAuth Role Claims
32+
33+
The Edit Role Admin UI can also be configured to Add/Remove Claims to a Role, e.g:
34+
35+
![](/img/posts/identityauth-claims-roles/identityauth-role-claims.webp)
36+
37+
Any Added or Removed Claims are applied after clicking **Update Role**, so you exit the UI without applying any
38+
changes by clicking **Cancel**.
39+
40+
Claims added to Roles have similar behavior to having Claims individually applied to all Users with that Role such that
41+
when a User is Authenticated they're populated with all claims assigned to their Roles in addition to their individual User Claims.
42+
43+
### IdentityAuth User Claims
44+
45+
Whilst the new User Claim Management UI allows you to assign Claims to individual Users:
46+
47+
![](/img/posts/identityauth-claims-roles/identityauth-user-claims.webp)
48+
49+
## Validating Claims
50+
51+
Claims are attestations or attributes about a User which we can use to restrict access to APIs to only Users who
52+
have been assigned that claim. We could use this to implement a permission system that restricts usage with a
53+
`todos:write` permission with something like:
54+
55+
```csharp
56+
[ValidateHasClaim("perm", "todos:write")]
57+
class CreateTodo {}
58+
```
59+
60+
Normally this would result in the generic missing claims error message:
61+
62+
:::{.not-prose}
63+
<error-summary :status="{message:`perm Claim with 'todos:write' is Required`}"></error-summary>
64+
:::
65+
66+
But as the `perm` claim has a customized error message:
67+
68+
```csharp
69+
HasClaimValidator.ClaimErrorMessages["perm"]= "`${Value} Permission Required`";
70+
```
71+
72+
It will generate that Error Response instead:
73+
74+
:::{.not-prose}
75+
<error-summary :status="{message:`'todos:write' Permission Required`}"></error-summary>
76+
:::
77+
78+
Which is a good example showing how `HasClaimValidator.ClaimErrorMessages` can be used to add custom error messages
79+
for your own custom claim validation.
80+
81+
### Inspecting Claims inside Services
82+
83+
You can also inspect and validate a Users Claim by inspecting the Authenticated ClaimsPrincipal, e.g:
84+
85+
```csharp
86+
public class TodoServices : Service
87+
{
88+
public object Any(CreateTodo request)
89+
{
90+
var user = Request.GetClaimsPrincipal();
91+
if (!user.HasClaim("perm", "todos:write"))
92+
throw HttpError.Forbidden("todos:write Permission Required");
93+
94+
var allUserClaims = user.Claims.ToList();
95+
//...
96+
}
97+
}
98+
```

‎MyApp/_posts/2025-04-17_analytics.md

+236
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,236 @@
1+
---
2+
title: In Depth and Interactive API Analytics available to all ServiceStack Apps
3+
summary: With support for adding Roles and User and Role Claims, the built-in Admin UI now offers complete Identity Auth management
4+
tags: [analytics,admin-ui,apis,sqlite]
5+
author: Demis Bellot
6+
image: https://images.unsplash.com/photo-1666875753105-c63a6f3bdc86?crop=entropy&fit=crop&h=1000&w=2000
7+
---
8+
9+
The big ticket feature of ServiceStack v8.7 is the comprehensive API Analytics available to all ServiceStack Apps
10+
configured with [SQLite Request Logging](https://docs.servicestack.net/sqlite-request-logs).
11+
12+
### Benefits of API Analytics
13+
14+
They provide deep and invaluable insight into your System API Usage, device distribution, its Users, API Keys and the
15+
IPs where most traffic generates:
16+
17+
- **Visibility:** Provides a clear, visual summary of complex log data, making it easier to understand API usage and performance at a glance.
18+
- **Performance Monitoring:** Helps track key metrics like request volume and response times to ensure APIs are meeting performance expectations.
19+
- **User Understanding:** Offers insights into how users (and bots) are interacting with the APIs (devices, browsers).
20+
- **Troubleshooting:** Aids in quickly identifying trends, anomalies, or specific endpoints related to issues.
21+
- **Resource Planning:** Understanding usage patterns helps in scaling infrastructure appropriately.
22+
- **Security Insight:** Identifying bot traffic and unusual request patterns can be an early indicator of security concerns.
23+
24+
### Interactive Analytics
25+
26+
Analytics are also interactive where you're able to drill down to monitor the activity of individual APIs, Users, API Keys
27+
and IPs which have further links back to the request logs which the summary analytics are derived from.
28+
29+
As they offer significant and valuable insights they're now built into all ASP.NET Core IdentityAuth templates,
30+
existing .NET 8 IdentityAuth templates can enable it with:
31+
32+
:::sh
33+
x mix sqlitelogs
34+
:::
35+
36+
.NET 8 Templates that are not configured to use [Endpoint Routing](https://docs.servicestack.net/endpoint-routing)
37+
and [ASP.NET Core IOC](https://docs.servicestack.net/net-ioc) will need to explicitly register `SqliteRequestLogger`
38+
as a singleton dependency in addition to configuring it on the `RequestLogsFeature` plugin:
39+
40+
```csharp
41+
public class ConfigureRequestLogs : IHostingStartup
42+
{
43+
public void Configure(IWebHostBuilder builder) => builder
44+
.ConfigureServices((context, services) =>
45+
{
46+
var logger = new SqliteRequestLogger();
47+
services.AddSingleton<IRequestLogger>(logger);
48+
49+
services.AddPlugin(new RequestLogsFeature {
50+
RequestLogger = logger,
51+
EnableRequestBodyTracking = true,
52+
EnableErrorTracking = true
53+
});
54+
services.AddHostedService<RequestLogsHostedService>();
55+
56+
if (context.HostingEnvironment.IsDevelopment())
57+
{
58+
services.AddPlugin(new ProfilingFeature());
59+
}
60+
});
61+
}
62+
```
63+
64+
This will enable a more feature rich Request Logging Admin UI which utilizes the full queryability of an AutoQueryGrid
65+
to filter, sort and export Request Logs.
66+
67+
[![](/img/posts/analytics/sqlitelogs.webp)](/img/posts/analytics/sqlitelogs.webp)
68+
69+
## Analytics Overview
70+
71+
Utilizing an `SqliteRequestLogger` will also enable the new **Analytics** Admin UI in the sidebar which initially
72+
displays the API Analytics Dashboard:
73+
74+
[![](/img/posts/analytics/analytics-apis1.webp)](/img/posts/analytics/analytics-apis1.webp)
75+
76+
### Distribution Pie Charts
77+
78+
Lets you quickly understand the composition of your user base and traffic sources and the
79+
distribution of users across different web browsers, device types, and to identify the proportion of traffic coming from automated bots.
80+
81+
### Requests per day Line Chart
82+
83+
Lets you monitor API usage trends and performance over time. It tracks the total number of API requests and the average response
84+
time day-by-day. You can easily spot trends like peak usage hours/days, identify sudden spikes or drops in traffic,
85+
and correlate request volume with API performance which is crucial for capacity planning and performance troubleshooting.
86+
87+
### API tag groups Pie Chart
88+
89+
Lets you understand the usage patterns across different functional categories of your APIs.
90+
By grouping API requests based on assigned tags (like Security, Authentication, User Management, Tech, etc.), you get a
91+
high-level view of which *types* of functionalities are most frequently used or are generating the most load.
92+
93+
### API Requests Bar Chart
94+
95+
Lets you identify the most and least frequently used specific API endpoints which ranks individual API endpoints by
96+
the number of requests they receive. This helps pinpoint:
97+
98+
- **Critical Endpoints:** The most heavily used APIs that require robust performance and monitoring.
99+
- **Optimization Targets:** High-traffic endpoints that could benefit from performance optimization.
100+
- **Underutilized Endpoints:** APIs that might be candidates for deprecation or require promotion.
101+
- **Troubleshooting:** If performance issues arise (seen in the line chart), this helps narrow down which specific endpoint might be responsible.
102+
103+
[![](/img/posts/analytics/analytics-apis2.webp)](/img/posts/analytics/analytics-apis2.webp)
104+
105+
### Total Duration Bar Chart
106+
107+
Identifies which API endpoints consume the most *cumulative processing time* over the selected period.
108+
Even if an API endpoint is relatively fast per call, if it's called extremely frequently, it can contribute significantly to overall server load.
109+
Optimizing these can lead to significant savings in server resources (CPU, memory).
110+
111+
### Average Duration Bar Chart
112+
113+
Pinpoints which API endpoints are the slowest on a *per-request* basis. APIs at the top of this list are prime candidates
114+
for performance investigation and optimization, as they represent potential user-facing slowness or system bottlenecks.
115+
116+
### Requests by Duration Ranges Histogram
117+
118+
Provides an overview of the performance distribution for *all* API requests.
119+
This chart shows how many requests fall into different speed buckets and helps you understand the overall responsiveness of your API system at a glance.
120+
121+
## Individual API Analytics
122+
123+
Clicking on an API's bar chart displays a dedicated, detailed view of a single API endpoint's behavior, isolating its performance
124+
and usage patterns from the overall system metrics offering immediate insight into the endpoint's traffic volume and reliability.
125+
126+
[![](/img/posts/analytics/analytics-api.webp)](/img/posts/analytics/analytics-api.webp)
127+
128+
### Total Requests
129+
130+
Displays the total requests for an API during the selected month. It includes HTTP Status Breakdown which
131+
provide **direct access to the filtered request logs**. This is a major benefit for **rapid troubleshooting**, allowing
132+
you to instantly view the specific log entries corresponding to successful requests or particular error codes for this API.
133+
134+
### Last Request Information
135+
136+
Provides immediate context on the most recent activity for this endpoint with *when* the last request occurred,
137+
the source **IP address** and device information to help understand recent usage and check if the endpoint is still active,
138+
or quickly investigate the very last interaction if needed.
139+
140+
### Duration Summary Table (Total, Min, Max)
141+
142+
Quantifies the performance characteristics specifically for this endpoint with the cumulative (Total) processing load,
143+
the best-case performance (Min), and the worst-case performance (Max) which is useful for identifying performance outliers.
144+
145+
### Duration Requests Histogram
146+
147+
Visualizes the performance distribution for this API.
148+
149+
### Top Users Bar Chart
150+
151+
Identifies which authenticated users are most frequently calling this API and relies on this endpoint the most.
152+
This can be useful for identifying power users, potential API abuse by a specific user account, or understanding the impact of changes to this API on key users.
153+
154+
### Top IP Addresses Bar Chart
155+
156+
Shows which source IP addresses are generating the most traffic for this API.
157+
Useful for identifying high-volume clients, specific servers interacting with this endpoint, or potentially malicious IPs.
158+
159+
## Users
160+
161+
The **Users** tab will display the top 100 Users who make the most API Requests and lets you click on a Users bar chart
162+
to view their individual User analytics.
163+
164+
[![](/img/posts/analytics/analytics-users.webp)](/img/posts/analytics/analytics-users.webp)
165+
166+
### Individual User Analytics
167+
168+
Provides a comprehensive view of a single user's complete interaction history and behavior across all APIs they've accessed,
169+
shifting the focus from API performance to user experience and activity.
170+
171+
[![](/img/posts/analytics/analytics-user.webp)](/img/posts/analytics/analytics-user.webp)
172+
173+
### User Info & Total Requests
174+
175+
Identifies the user and quantifies their overall activity level. Clicking on their ID or Name will navigate to the Users Admin UI.
176+
It also shows their success/error rate via the clickable status code links. This helps gauge user engagement and baseline activity.
177+
178+
### Last Request Information
179+
180+
Offers a snapshot of the user's most recent interaction for immediate context.
181+
Knowing **when**, **what** API they called, from which **IP address**, using which **client** & **device** is valuable
182+
for support, identifying their last action or checking recent activity.
183+
184+
### HTTP Status Pie Chart
185+
186+
Visualizes the overall success and error rate specifically for this user's API requests.
187+
188+
### Performance & Request Body Summary Table
189+
190+
Quantifies the performance experienced by this user and the data they typically send.
191+
192+
### Duration Requests Histogram
193+
194+
Shows the distribution of response times for requests made by this user to help understand the typical performance this user experiences.
195+
196+
### Top APIs Bar Chart
197+
198+
Reveals which API endpoints this user interacts with most frequently and help understanding user behavior and which features they use most.
199+
200+
### Top IP Addresses Bar Chart
201+
202+
Identifies the primary network locations or devices the user connects from.
203+
204+
### User Admin UI Analytics
205+
206+
To assist in discoverability a snapshot of a Users Analytics is also visible in the Users Admin UI:
207+
208+
[![](/img/posts/analytics/analytics-user-adminui.webp)](/img/posts/analytics/analytics-user-adminui.webp)
209+
210+
Clicking on **View User Analytics** takes you to the Users Analytics page to access to the full Analytics features and navigation.
211+
212+
## API Keys
213+
214+
The **API Keys** tab will display the top 100 API Keys who make the most API Requests and lets you click on an API Key
215+
bar chart to view its individual API Key analytics.
216+
217+
[![](/img/posts/analytics/analytics-apikeys.webp)](/img/posts/analytics/analytics-apikeys.webp)
218+
219+
### Individual API Key Analytics
220+
221+
Provides comprehensive API Key analytics Similar to User Analytics but limited to the API Usage of a single API Key:
222+
223+
[![](/img/posts/analytics/analytics-apikey.webp)](/img/posts/analytics/analytics-apikey.webp)
224+
225+
## IPs
226+
227+
The **IP Addresses** tab will display the top 100 IPs that make the most API Requests. Click on an IP's
228+
bar chart to view its individual analytics made from that IP Address.
229+
230+
[![](/img/posts/analytics/analytics-ips.webp)](/img/posts/analytics/analytics-ips.webp)
231+
232+
### Individual IP Analytics
233+
234+
Provides comprehensive IP Address analytics Similar to User Analytics but limited to the API Usage from a single IP Address:
235+
236+
[![](/img/posts/analytics/analytics-ip.webp)](/img/posts/analytics/analytics-ip.webp)

0 commit comments

Comments
 (0)