--- title: SAIF.NetCore.AuthService API reference summary: Index of all public types in this library. status: draft owner: Framework.NCore maintainers last_reviewed: 2026-10-02 library: SAIF.NetCore.AuthService reference_type: package --- # SAIF.NetCore.AuthService API reference This page lists all public types exposed by `SAIF.NetCore.AuthService`. Each type links to its full API reference page. ## Types | Type | Kind | Namespace | Purpose | | --- | --- | --- | --- | | [AuthenticationServiceExtensions](SAIF.NetCore.Services.Authentication.Extensions/AuthenticationServiceExtensions.md) | Class | `SAIF.NetCore.Services.Authentication.Extensions` | Register identity-service implementations (`AddTokenIdentityService`, `AddWinIdentityService`, `AddIdentityAccessor`) and the Security API/token clients they depend on. | | [BaseIdentityService](SAIF.NetCore.Services.Authentication.Identity/BaseIdentityService.md) | Class | `SAIF.NetCore.Services.Authentication.Identity` | Expose the current `ClaimsIdentity`/`ClaimsPrincipal`/claims and an `IsAuthenticated` flag derived from the current `HttpContext`'s user. | | [ConfigureJwtBearerOptions](SAIF.NetCore.Services.Authentication/ConfigureJwtBearerOptions.md) | Class | `SAIF.NetCore.Services.Authentication` | Populate `Authority`, `Audience`, and `RequireHttpsMetadata` on `JwtBearerOptions` from the `oauth` settings section via the injected `IEnvironmentClient` ([BR-AUTH-001](../business-rules.md#br-auth-001-jwt-options-are-only-populated-for-the-bearer-scheme)). | | [IAccessTokenClient](SAIF.NetCore.Services.Authentication.Interfaces/IAccessTokenClient.md) | Interface | `SAIF.NetCore.Services.Authentication.Interfaces` | Expose the configuration needed to request a client-credentials token (`TokenUrl`, `ClientId`, `ClientSecret`, `GrantType`, `Scopes`) as settable properties. | | [ISecurityClient](SAIF.NetCore.Services.Authentication.Interfaces/ISecurityClient.md) | Interface | `SAIF.NetCore.Services.Authentication.Interfaces` | Declare the full set of remote Security API operations consumed by identity services and the declarative authorization pipeline. | | [IdentityServiceAccessor](SAIF.NetCore.Services.Authentication.Identity/IdentityServiceAccessor.md) | Class | `SAIF.NetCore.Services.Authentication.Identity` | Resolve the single registered `IIdentityService` from `IServiceProvider` on demand, with no scheme-switching logic. | | [MultiIdentityServiceAccessor](SAIF.NetCore.Services.Authentication.Identity/MultiIdentityServiceAccessor.md) | Class | `SAIF.NetCore.Services.Authentication.Identity` | Select between `TokenIdentityService` and `WinIdentityService` per request, based on `AuthenticationSchemeSelector(HttpContext)` ([BR-AUTH-015](../business-rules.md#br-auth-015-authorization-header-prefix-selects-the-dual-authentication-scheme)). | | [OktaToken](SAIF.NetCore.Services.Authentication.Clients/OktaToken.md) | Class | `SAIF.NetCore.Services.Authentication.Clients` | Hold the deserialized token-endpoint response fields (`access_token`, `expires_in`, `scope`, `token_type`). | | [OktaTokenClient](SAIF.NetCore.Services.Authentication.Clients/OktaTokenClient.md) | Class | `SAIF.NetCore.Services.Authentication.Clients` | Cache and reuse a previously acquired access token until it is near expiry ([BR-AUTH-017](../business-rules.md#br-auth-017-cached-okta-token-is-reused-until-near-expiry)). | | [SecurityApiAuthorize](SAIF.NetCore.Services.Authorization/SecurityApiAuthorize.md) | Class | `SAIF.NetCore.Services.Authorization` | Translate a role list into the dynamic policy name `"SecurityAPI.{roles}"` recognized by `SecurityApiPolicy` ([BR-AUTH-004](../business-rules.md#br-auth-004-securityapiauthorize-maps-roles-to-a-dynamic-policy-name)). | | [SecurityApiHandler](SAIF.NetCore.Services.Authorization/SecurityApiHandler.md) | Class | `SAIF.NetCore.Services.Authorization` | Deny (by omission) any identity whose `Identity.Name` is null or whitespace, without calling the remote Security API — an empty-name guard, not an authentication check ([BR-AUTH-006](../business-rules.md#br-auth-006-an-unnamed-identity-never-satisfies-a-securityapi-requirement)). | | [SecurityApiPolicy](SAIF.NetCore.Services.Authorization/SecurityApiPolicy.md) | Class | `SAIF.NetCore.Services.Authorization` | Recognize policy names starting with `"SecurityAPI"` (current-culture, case-sensitive comparison via the single-argument `StartsWith(string)` overload, not ordinal) and build a policy with a `SecurityApiRequirement` whose roles are the text after the first `.` ([BR-AUTH-005](../business-rules.md#br-auth-005-securityapi-prefixed-policy-names-resolve-to-a-securityapirequirement)). | | [SecurityApiRequirement](SAIF.NetCore.Services.Authorization/SecurityApiRequirement.md) | Class | `SAIF.NetCore.Services.Authorization` | Carry the comma-separated role list a `SecurityApiHandler` must check against the remote Security API. | | [SecurityClient](SAIF.NetCore.Services.Authentication.Clients/SecurityClient.md) | Class | `SAIF.NetCore.Services.Authentication.Clients` | Implement every `ISecurityClient` member by issuing a `GET` request to its endpoint-specific route under `/v1/` (for example `/v1/Users/GetUser/{userId}` or `/v1/Users/IsAuthorized/{userId}/{role}`) and deserializing the response. | | [SecurityClientException](SAIF.NetCore.Services.Authentication.Clients/SecurityClientException.md) | Class | `SAIF.NetCore.Services.Authentication.Clients` | Represent a failed remote Security API call as a typed, catchable exception distinct from other `SAIFException`-derived errors. | | [SecurityClientKeys](SAIF.NetCore.Services.Authentication.Clients/SecurityClientKeys.md) | Class | `SAIF.NetCore.Services.Authentication.Clients` | Centralize the `SecurityClient` settings-section name and its two setting-key names as public constants. | | [TokenIdentityService](SAIF.NetCore.Services.Authentication.Identity/TokenIdentityService.md) | Class | `SAIF.NetCore.Services.Authentication.Identity` | Resolve `UserId` from the first claim whose type contains `mailid` (case-insensitive) ([BR-AUTH-012](../business-rules.md#br-auth-012-token-user-id-comes-from-the-mailid-claim)). | | [WinIdentityService](SAIF.NetCore.Services.Authentication.Identity/WinIdentityService.md) | Class | `SAIF.NetCore.Services.Authentication.Identity` | Resolve `UserId` as the full domain-qualified `Identity.Name` (domain retained) ([BR-AUTH-014](../business-rules.md#br-auth-014-windows-user-id-keeps-the-domain-and-is-always-remote)). | ## Related documentation - [Index](../index.md) - [Overview](../overview.md) - [Architecture](../architecture.md) - [Dependencies](../dependencies.md) - [Configuration](../configuration.md) - [Service registration](../service-registration.md) - [Operations and processes](../operations-processes.md) - [Business rules](../business-rules.md) - [Security and authorization](../security-authorization.md) ## Sources - `src/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService.csproj`