---
title: SAIF.NetCore.AuthService dependencies
summary: Internal and external dependencies for this library.
status: draft
owner: Framework.NCore maintainers
last_reviewed: 2026-10-02
library: SAIF.NetCore.AuthService
reference_type: package
---

# SAIF.NetCore.AuthService dependencies

`SAIF.NetCore.AuthService` depends only on the foundation `SAIF.NetCore.ServiceContracts` package for its interfaces and exception base type, carries three third-party packages in the shipped assembly, and makes its own outbound HTTP calls to a remote SecurityAPI service and an OAuth token endpoint.

## Internal dependencies

| Dependency | Reference Type | Usage |
| --- | --- | --- |
| [SAIF.NetCore.ServiceContracts](../saif-netcore-servicecontracts/overview.md) | NuGet Package (same-repo) | Implements `IIdentityService`/`IIdentityServiceAccessor`; consumes `IEnvironmentClient`, `IHttpJsonClient`, `IHttpRequestResult`, `IUserProfile`/`UserProfile`, and `ExternalUser`; extends `SAIFException` for `SecurityClientException`. |

## External dependencies

| Dependency | Version | Usage |
| --- | --- | --- |
| `Microsoft.AspNetCore.Authentication.JwtBearer` | `6.0.11` | Supplies `JwtBearerOptions`/`JwtBearerDefaults` for `ConfigureJwtBearerOptions` and `AddJwtAuthentication`. A 6.0.x package on `net8.0;net10.0` target frameworks is a version mismatch*. |
| `Microsoft.AspNetCore.Authorization` | `6.0.11` | Supplies `AuthorizeAttribute`, `AuthorizationHandler<T>`, `IAuthorizationPolicyProvider`, and `DefaultAuthorizationPolicyProvider` for the `[SecurityApiAuthorize]` policy pipeline. Same version-mismatch note applies*. |
| `Newtonsoft.Json` | `13.0.1` | `JsonConvert`/`[JsonProperty]` deserialization of the `OktaToken` response in `OktaTokenClient`. |

## Transitive dependencies

Dependencies in this section are inherited from dependency framework libraries. They are not directly referenced by this library but are required at runtime through framework packages.

| Dependency | Source framework | Type | Usage |
| --- | --- | --- | --- |
| `Microsoft.AspNetCore.App` (shared framework: `IHttpContextAccessor`, `IISServerDefaults`, `AuthenticationBuilder`) | `Microsoft.AspNetCore.Authentication.JwtBearer` | Transitive | Supplies ASP.NET Core hosting types this library uses (`IHttpContextAccessor`, `IISServerDefaults`, `AuthenticationBuilder`) without the library declaring its own `<FrameworkReference>`*. |

## API dependencies

| Endpoint | Method | Called from | Source library | Reached via | Usage |
| --- | --- | --- | --- | --- | --- |
| `/v1/Users/IsAuthorized/{userId}/{suffixRole}` (relative to `SecurityClient:ServiceUrl`) | GET | `SecurityClient.IsAuthorized` | This library | — | Checks whether a user is authorized for a role (or resource-suffixed role); called by `SecurityApiHandler.HandleRequirementAsync` and as the fallback path in `TokenIdentityService.IsAuthorized`/always in `WinIdentityService.IsAuthorized`. |
| `/v1/Users/GetUser/{userId}` (relative to `SecurityClient:ServiceUrl`) | GET | `SecurityClient.GetUser` / `GetUser<T>` | This library | — | Retrieves the user's profile from the SecurityAPI as `UserProfile` (ServiceContracts) or a caller-supplied type. |
| `/v1/Users/GetUsersByGroup/{domain}/{groupName}?recurse={recurse}` (relative to `SecurityClient:ServiceUrl`) | GET | `SecurityClient.GetUsersByGroup` | This library | — | Retrieves the members of an Active Directory group, optionally recursing nested groups. |
| `/v1/users/applicationresource/{domain}/{username}` (relative to `SecurityClient:ServiceUrl`) | GET | `SecurityClient.GetAuthorizationGroups` | This library | — | Retrieves BOL application authorization resource group names for a user. |
| `/v1/ExternalData/User/{userId}` (relative to `SecurityClient:ServiceUrl`) | GET | `SecurityClient.GetExternalUser` | This library | — | Retrieves external-user data (sourced from EXT Oracle tables on the SecurityAPI side) as `ExternalUser` (ServiceContracts). |
| `{TokenUrl}` (consumer-configured OAuth token endpoint) | POST | `OktaTokenClient.GetNewAccessToken` | This library | — | Acquires a client-credentials access token using HTTP Basic authentication and a form body (`grant_type`, `scope`, `redirect_uri`), caching the result until it is near expiry. |

All five SecurityClient calls above are issued through the injected `IHttpJsonClient` (ServiceContracts contract); the `OktaTokenClient` call is issued through a separately constructed `System.Net.Http.HttpClient`, not through `IHttpJsonClient`. Both the SecurityAPI and the OAuth token endpoint are external HTTP services and are not part of this repository. The ASP.NET Core `JwtBearer` authentication handler also contacts the configured JWT authority's metadata endpoint at runtime; that call is framework behavior inside `Microsoft.AspNetCore.Authentication.JwtBearer`, not code in this library, so it is not listed as a row above*.

## Dependency risks and notes
- `IEnvironmentClient` and `IHttpJsonClient` are consumed only as ServiceContracts interfaces; this library does not reference `SAIF.NetCore.EnvironmentClient` or `SAIF.NetCore.HttpClients` directly, so the concrete implementations and their behavior are determined entirely by what the consuming application registers*.
- `SAIF.NetCore.NtlmApiAuth` takes a direct NuGet dependency on this library (the documented implementation-to-implementation exception in [`Architecture.md`](../../../Architecture.md)), pinned at the older version `8.2023.319.2` while this library's latest feed version is `10.2026.26267.1`; an application consuming both may see NuGet resolve to the higher version*.
- `OktaTokenClient` is registered as a singleton, constructs a new `HttpClient` per token refresh rather than reusing one, and depends on `IHttpContextAccessor.HttpContext` only to build `redirect_uri` on the refresh path; a cache hit returns the cached token without touching `HttpContext`, so calling `GetToken()` outside an active request only throws `NullReferenceException` when a refresh is actually needed*.
- The `Microsoft.AspNetCore.Authentication.JwtBearer` and `Microsoft.AspNetCore.Authorization` packages are pinned at `6.0.11` while the project targets `net8.0;net10.0`, a version mismatch whose compatibility implications were not independently verified**.
- The `resourcesuffix` values applied by `GetSuffixRole` (e.g. `Resource` vs. `TestResource`) are environment configuration not present in this repository, so the exact per-environment behavior of the `IsAuthorized` endpoint call cannot be fully verified from source alone**.

## Related documentation
- [Index](index.md)
- [Overview](overview.md)
- [Architecture](architecture.md)
- [Configuration](configuration.md)
- [Operations and processes](operations-processes.md)
- [Business rules](business-rules.md)
- [Security and authorization](security-authorization.md)
- [Service registration](service-registration.md)
- [API reference](api/index.md)
- [SAIF.NetCore.ServiceContracts overview](../saif-netcore-servicecontracts/overview.md)

> **Note:** Statements marked with `*` were inferred from code structure, naming
> conventions, or contextual evidence where direct confirmation was not available
> in source artifacts. Statements marked with `**` could not be confirmed; treat
> as unknown until verified.

## Sources
- `src/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService.csproj`
- `src/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/Clients/SecurityClient.cs`, `OktaTokenClient.cs`, `SecurityClientException.cs`
- `src/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/Identity/TokenIdentityService.cs`, `WinIdentityService.cs`
- `src/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/Authorization/SecurityApiHandler.cs`
- `src/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/Interfaces/ISecurityClient.cs`, `IAccessTokenClient.cs`
- `src/SAIF.NetCore.ServiceContracts/SAIF.NetCore.ServiceContracts/SAIF.NetCore.ServiceContracts/IEnvironmentClient.cs`, `IHttpJsonClient.cs`, `IHttpRequestResult.cs`, `IUserProfile.cs`, `UserProfile.cs`, `ExternalUser.cs`, `SAIFException.cs`
- `src/SAIF.NetCore.NtlmApiAuth/src/SAIF.NetCore.NtlmApiAuth/SAIF.NetCore.NtlmApiAuth.csproj`
- `Architecture.md`