---
title: SAIF.NetCore.AuthService operations and processes
summary: Catalog of operations and processes implemented by this library, with links to detailed operation pages.
status: draft
owner: Framework.NCore maintainers
last_reviewed: 2026-10-02
library: SAIF.NetCore.AuthService
reference_type: package
---

# SAIF.NetCore.AuthService operations and processes

This library implements fifteen operations spanning JWT options configuration, the declarative `[SecurityApiAuthorize]` authorization pipeline, the remote SecurityApi client, current-user identity resolution, dual authentication scheme selection, outbound OAuth token acquisition, and DI registration. None of these operations perform any SQL or database access — all remote calls go through `IHttpJsonClient` (SecurityApi) or a raw `HttpClient` (Okta token endpoint).

## Operations catalog

| Operation ID | Operation | Trigger | Rules |
| --- | --- | --- | --- |
| OP-01 | [Configure JWT Bearer options](operations/configure-jwt-bearer-options.md) | The ASP.NET Core options framework materializes named `JwtBearerOptions` for a configured scheme. | [BR-AUTH-001](business-rules.md#br-auth-001-jwt-options-are-only-populated-for-the-bearer-scheme), [BR-AUTH-002](business-rules.md#br-auth-002-per-application-oauth-overrides-take-precedence), [BR-AUTH-003](business-rules.md#br-auth-003-the-unnamed-configure-overload-is-a-no-op) |
| OP-02 | [Resolve a SecurityAPI authorization policy](operations/resolve-a-securityapi-authorization-policy.md) | ASP.NET Core authorization middleware requests a named policy for an action decorated with `[SecurityApiAuthorize]`. | [BR-AUTH-004](business-rules.md#br-auth-004-securityapiauthorize-maps-roles-to-a-dynamic-policy-name), [BR-AUTH-005](business-rules.md#br-auth-005-securityapi-prefixed-policy-names-resolve-to-a-securityapirequirement) |
| OP-03 | [Evaluate a SecurityApiRequirement](operations/evaluate-a-securityapirequirement.md) | ASP.NET Core authorization middleware evaluates the built policy's `SecurityApiRequirement` against the current `ClaimsPrincipal`. | [BR-AUTH-006](business-rules.md#br-auth-006-an-unnamed-identity-never-satisfies-a-securityapi-requirement), [BR-AUTH-007](business-rules.md#br-auth-007-the-handler-strips-the-windows-domain-before-calling-the-securityapi), [BR-AUTH-008](business-rules.md#br-auth-008-comma-separated-roles-use-or-semantics) |
| OP-04 | [Check role authorization remotely](operations/check-role-authorization-remotely.md) | Any caller — `SecurityApiHandler`, `TokenIdentityService`, `WinIdentityService`, or external consumers such as `SAIF.NetCore.NtlmApiAuth` — needs a remote role-authorization decision. | [BR-AUTH-009](business-rules.md#br-auth-009-backslashes-in-user-ids-are-rewritten-to-forward-slashes), [BR-AUTH-010](business-rules.md#br-auth-010-environment-resource-suffix-rewrite), [BR-AUTH-011](business-rules.md#br-auth-011-a-non-successful-securityapi-response-always-throws) |
| OP-05 | [Get user profile](operations/get-user-profile.md) | Caller code requests a user's profile data. | [BR-AUTH-009](business-rules.md#br-auth-009-backslashes-in-user-ids-are-rewritten-to-forward-slashes), [BR-AUTH-011](business-rules.md#br-auth-011-a-non-successful-securityapi-response-always-throws) |
| OP-06 | [Get users by AD group](operations/get-users-by-ad-group.md) | Caller code requests the membership of an AD group. | [BR-AUTH-011](business-rules.md#br-auth-011-a-non-successful-securityapi-response-always-throws) |
| OP-07 | [Get application authorization groups](operations/get-application-authorization-groups.md) | Caller code requests the BOL application authorization resource group names for a user. | [BR-AUTH-011](business-rules.md#br-auth-011-a-non-successful-securityapi-response-always-throws) |
| OP-08 | [Get external user](operations/get-external-user.md) | Caller code requests external-user data (sourced from EXT oracle tables by the remote service). | [BR-AUTH-011](business-rules.md#br-auth-011-a-non-successful-securityapi-response-always-throws) |
| OP-09 | [Authorize the current user (token identity)](operations/authorize-current-user-token.md) | Consumer code calls `IsAuthorized(role)` on an `IIdentityService` resolved to a `TokenIdentityService`. | [BR-AUTH-012](business-rules.md#br-auth-012-token-user-id-comes-from-the-mailid-claim), [BR-AUTH-013](business-rules.md#br-auth-013-token-users-can-authorize-locally-via-a-role-claim) |
| OP-10 | [Authorize the current user (Windows identity)](operations/authorize-current-user-windows.md) | Consumer code calls `IsAuthorized(role)` on an `IIdentityService` resolved to a `WinIdentityService`. | [BR-AUTH-014](business-rules.md#br-auth-014-windows-user-id-keeps-the-domain-and-is-always-remote) |
| OP-11 | [Select the dual authentication scheme](operations/select-dual-authentication-scheme.md) | The `"dual"` policy scheme (registered by `AddDualAuthentication`) needs to forward an incoming request to a concrete authentication handler. | [BR-AUTH-015](business-rules.md#br-auth-015-authorization-header-prefix-selects-the-dual-authentication-scheme) |
| OP-12 | [Resolve the current identity service](operations/resolve-the-current-identity-service.md) | Consumer code resolves `IIdentityServiceAccessor.IdentityService` from DI. | [BR-AUTH-016](business-rules.md#br-auth-016-no-httpcontext-defaults-the-multi-accessor-to-windows) |
| OP-13 | [Acquire an outbound access token](operations/acquire-an-outbound-access-token.md) | Consumer code calls `IAccessTokenClient.GetToken()` before calling a downstream API. | [BR-AUTH-017](business-rules.md#br-auth-017-cached-okta-token-is-reused-until-near-expiry), [BR-AUTH-018](business-rules.md#br-auth-018-outbound-token-requests-use-http-basic-client-credentials) |
| OP-14 | [Register authentication and authorization services](operations/register-authentication-services.md) | A consuming application's `Startup`/composition code calls one or more `AuthenticationServiceExtensions` extension methods. | — |
| OP-15 | [Handle a Security API response](operations/handle-a-security-api-response.md) | Any `SecurityClient` method (OP-04 through OP-08) completes its underlying remote GET call. | [BR-AUTH-011](business-rules.md#br-auth-011-a-non-successful-securityapi-response-always-throws) |

## Process flow diagram

```mermaid
flowchart TD
    subgraph Authentication
        OP01[OP-01 Configure JWT Bearer options]
        OP11[OP-11 Select dual authentication scheme]
        OP14[OP-14 Register authentication services]
    end
    subgraph Declarative authorization
        OP02[OP-02 Resolve a SecurityAPI authorization policy]
        OP03[OP-03 Evaluate a SecurityApiRequirement]
    end
    subgraph Identity and remote checks
        OP12[OP-12 Resolve the current identity service]
        OP09["OP-09 Authorize current user, token"]
        OP10["OP-10 Authorize current user, Windows"]
        OP04[OP-04 Check role authorization remotely]
        OP15[OP-15 Handle a Security API response]
    end
    subgraph SecurityApi data lookups
        OP05[OP-05 Get user profile]
        OP06[OP-06 Get users by AD group]
        OP07[OP-07 Get application authorization groups]
        OP08[OP-08 Get external user]
    end
    subgraph Outbound credentialing
        OP13[OP-13 Acquire an outbound access token]
    end

    OP14 --> OP01
    OP14 --> OP02
    OP14 --> OP03
    OP11 --> OP12
    OP02 --> OP03
    OP03 --> OP04
    OP12 --> OP09
    OP12 --> OP10
    OP09 --> OP04
    OP10 --> OP04
    OP04 --> OP15
    OP05 --> OP15
    OP06 --> OP15
    OP07 --> OP15
    OP08 --> OP15
```

## Related documentation
- [Index](index.md)
- [Overview](overview.md)
- [Architecture](architecture.md)
- [Dependencies](dependencies.md)
- [Configuration](configuration.md)
- [Business rules](business-rules.md)
- [Security and authorization](security-authorization.md)
- [Service registration](service-registration.md)
- [API reference](api/index.md)

## Sources
- `src/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/ConfigureJwtBearerOptions.cs`
- `src/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/Authorization/SecurityApiAuthorize.cs`
- `src/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/Authorization/SecurityAPIPolicy.cs`
- `src/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/Authorization/SecurityApiHandler.cs`
- `src/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/Clients/SecurityClient.cs`
- `src/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/Clients/OktaTokenClient.cs`
- `src/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/Identity/TokenIdentityService.cs`
- `src/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/Identity/WinIdentityService.cs`
- `src/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/Identity/MultiIdentityServiceAccessor.cs`
- `src/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/Identity/IdentityServiceAccessor.cs`
- `src/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/Extensions/AuthenticationServiceExtensions.cs`