SAIF.NetCore.AuthService dependencies

SAIF.NetCore.AuthService depends only on the foundation SAIF.NetCore.ServiceContracts package for its interfaces and exception base type, carries three third-party packages in the shipped assembly, and makes its own outbound HTTP calls to a remote SecurityAPI service and an OAuth token endpoint.

Internal dependencies

Dependency	Reference Type	Usage
SAIF.NetCore.ServiceContracts	NuGet Package (same-repo)	Implements IIdentityService/IIdentityServiceAccessor; consumes IEnvironmentClient, IHttpJsonClient, IHttpRequestResult, IUserProfile/UserProfile, and ExternalUser; extends SAIFException for SecurityClientException.

External dependencies

Dependency	Version	Usage
Microsoft.AspNetCore.Authentication.JwtBearer	6.0.11	Supplies JwtBearerOptions/JwtBearerDefaults for ConfigureJwtBearerOptions and AddJwtAuthentication. A 6.0.x package on net8.0;net10.0 target frameworks is a version mismatch*.
Microsoft.AspNetCore.Authorization	6.0.11	Supplies AuthorizeAttribute, AuthorizationHandler<T>, IAuthorizationPolicyProvider, and DefaultAuthorizationPolicyProvider for the [SecurityApiAuthorize] policy pipeline. Same version-mismatch note applies*.
Newtonsoft.Json	13.0.1	JsonConvert/[JsonProperty] deserialization of the OktaToken response in OktaTokenClient.

Transitive dependencies

Dependencies in this section are inherited from dependency framework libraries. They are not directly referenced by this library but are required at runtime through framework packages.

Dependency	Source framework	Type	Usage
Microsoft.AspNetCore.App (shared framework: IHttpContextAccessor, IISServerDefaults, AuthenticationBuilder)	Microsoft.AspNetCore.Authentication.JwtBearer	Transitive	Supplies ASP.NET Core hosting types this library uses (IHttpContextAccessor, IISServerDefaults, AuthenticationBuilder) without the library declaring its own <FrameworkReference>*.

API dependencies

Endpoint	Method	Called from	Source library	Reached via	Usage
/v1/Users/IsAuthorized/{userId}/{suffixRole} (relative to SecurityClient:ServiceUrl)	GET	SecurityClient.IsAuthorized	This library	—	Checks whether a user is authorized for a role (or resource-suffixed role); called by SecurityApiHandler.HandleRequirementAsync and as the fallback path in TokenIdentityService.IsAuthorized/always in WinIdentityService.IsAuthorized.
/v1/Users/GetUser/{userId} (relative to SecurityClient:ServiceUrl)	GET	SecurityClient.GetUser / GetUser<T>	This library	—	Retrieves the user's profile from the SecurityAPI as UserProfile (ServiceContracts) or a caller-supplied type.
/v1/Users/GetUsersByGroup/{domain}/{groupName}?recurse={recurse} (relative to SecurityClient:ServiceUrl)	GET	SecurityClient.GetUsersByGroup	This library	—	Retrieves the members of an Active Directory group, optionally recursing nested groups.
/v1/users/applicationresource/{domain}/{username} (relative to SecurityClient:ServiceUrl)	GET	SecurityClient.GetAuthorizationGroups	This library	—	Retrieves BOL application authorization resource group names for a user.
/v1/ExternalData/User/{userId} (relative to SecurityClient:ServiceUrl)	GET	SecurityClient.GetExternalUser	This library	—	Retrieves external-user data (sourced from EXT Oracle tables on the SecurityAPI side) as ExternalUser (ServiceContracts).
{TokenUrl} (consumer-configured OAuth token endpoint)	POST	OktaTokenClient.GetNewAccessToken	This library	—	Acquires a client-credentials access token using HTTP Basic authentication and a form body (grant_type, scope, redirect_uri), caching the result until it is near expiry.

All five SecurityClient calls above are issued through the injected IHttpJsonClient (ServiceContracts contract); the OktaTokenClient call is issued through a separately constructed System.Net.Http.HttpClient, not through IHttpJsonClient. Both the SecurityAPI and the OAuth token endpoint are external HTTP services and are not part of this repository. The ASP.NET Core JwtBearer authentication handler also contacts the configured JWT authority's metadata endpoint at runtime; that call is framework behavior inside Microsoft.AspNetCore.Authentication.JwtBearer, not code in this library, so it is not listed as a row above*.

Dependency risks and notes

• IEnvironmentClient and IHttpJsonClient are consumed only as ServiceContracts interfaces; this library does not reference SAIF.NetCore.EnvironmentClient or SAIF.NetCore.HttpClients directly, so the concrete implementations and their behavior are determined entirely by what the consuming application registers*.
• SAIF.NetCore.NtlmApiAuth takes a direct NuGet dependency on this library (the documented implementation-to-implementation exception in Architecture.md), pinned at the older version 8.2023.319.2 while this library's latest feed version is 10.2026.26267.1; an application consuming both may see NuGet resolve to the higher version*.
• OktaTokenClient is registered as a singleton, constructs a new HttpClient per token refresh rather than reusing one, and depends on IHttpContextAccessor.HttpContext only to build redirect_uri on the refresh path; a cache hit returns the cached token without touching HttpContext, so calling GetToken() outside an active request only throws NullReferenceException when a refresh is actually needed*.
• The Microsoft.AspNetCore.Authentication.JwtBearer and Microsoft.AspNetCore.Authorization packages are pinned at 6.0.11 while the project targets net8.0;net10.0, a version mismatch whose compatibility implications were not independently verified**.
• The resourcesuffix values applied by GetSuffixRole (e.g. Resource vs. TestResource) are environment configuration not present in this repository, so the exact per-environment behavior of the IsAuthorized endpoint call cannot be fully verified from source alone**.

Related documentation

• Index
• Overview
• Architecture
• Configuration
• Operations and processes
• Business rules
• Security and authorization
• Service registration
• API reference
• SAIF.NetCore.ServiceContracts overview

Note: Statements marked with * were inferred from code structure, naming conventions, or contextual evidence where direct confirmation was not available in source artifacts. Statements marked with ** could not be confirmed; treat as unknown until verified.

Sources

• src/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService.csproj
• src/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/Clients/SecurityClient.cs, OktaTokenClient.cs, SecurityClientException.cs
• src/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/Identity/TokenIdentityService.cs, WinIdentityService.cs
• src/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/Authorization/SecurityApiHandler.cs
• src/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/Interfaces/ISecurityClient.cs, IAccessTokenClient.cs
• src/SAIF.NetCore.ServiceContracts/SAIF.NetCore.ServiceContracts/SAIF.NetCore.ServiceContracts/IEnvironmentClient.cs, IHttpJsonClient.cs, IHttpRequestResult.cs, IUserProfile.cs, UserProfile.cs, ExternalUser.cs, SAIFException.cs
• src/SAIF.NetCore.NtlmApiAuth/src/SAIF.NetCore.NtlmApiAuth/SAIF.NetCore.NtlmApiAuth.csproj
• Architecture.md