SAIF.NetCore.AuthService operations and processes

This library implements fifteen operations spanning JWT options configuration, the declarative [SecurityApiAuthorize] authorization pipeline, the remote SecurityApi client, current-user identity resolution, dual authentication scheme selection, outbound OAuth token acquisition, and DI registration. None of these operations perform any SQL or database access — all remote calls go through IHttpJsonClient (SecurityApi) or a raw HttpClient (Okta token endpoint).

Operations catalog

Operation ID	Operation	Trigger	Rules
OP-01	Configure JWT Bearer options	The ASP.NET Core options framework materializes named JwtBearerOptions for a configured scheme.	BR-AUTH-001, BR-AUTH-002, BR-AUTH-003
OP-02	Resolve a SecurityAPI authorization policy	ASP.NET Core authorization middleware requests a named policy for an action decorated with [SecurityApiAuthorize].	BR-AUTH-004, BR-AUTH-005
OP-03	Evaluate a SecurityApiRequirement	ASP.NET Core authorization middleware evaluates the built policy's SecurityApiRequirement against the current ClaimsPrincipal.	BR-AUTH-006, BR-AUTH-007, BR-AUTH-008
OP-04	Check role authorization remotely	Any caller — SecurityApiHandler, TokenIdentityService, WinIdentityService, or external consumers such as SAIF.NetCore.NtlmApiAuth — needs a remote role-authorization decision.	BR-AUTH-009, BR-AUTH-010, BR-AUTH-011
OP-05	Get user profile	Caller code requests a user's profile data.	BR-AUTH-009, BR-AUTH-011
OP-06	Get users by AD group	Caller code requests the membership of an AD group.	BR-AUTH-011
OP-07	Get application authorization groups	Caller code requests the BOL application authorization resource group names for a user.	BR-AUTH-011
OP-08	Get external user	Caller code requests external-user data (sourced from EXT oracle tables by the remote service).	BR-AUTH-011
OP-09	Authorize the current user (token identity)	Consumer code calls IsAuthorized(role) on an IIdentityService resolved to a TokenIdentityService.	BR-AUTH-012, BR-AUTH-013
OP-10	Authorize the current user (Windows identity)	Consumer code calls IsAuthorized(role) on an IIdentityService resolved to a WinIdentityService.	BR-AUTH-014
OP-11	Select the dual authentication scheme	The "dual" policy scheme (registered by AddDualAuthentication) needs to forward an incoming request to a concrete authentication handler.	BR-AUTH-015
OP-12	Resolve the current identity service	Consumer code resolves IIdentityServiceAccessor.IdentityService from DI.	BR-AUTH-016
OP-13	Acquire an outbound access token	Consumer code calls IAccessTokenClient.GetToken() before calling a downstream API.	BR-AUTH-017, BR-AUTH-018
OP-14	Register authentication and authorization services	A consuming application's Startup/composition code calls one or more AuthenticationServiceExtensions extension methods.	—
OP-15	Handle a Security API response	Any SecurityClient method (OP-04 through OP-08) completes its underlying remote GET call.	BR-AUTH-011

Process flow diagram

flowchart TD
    subgraph Authentication
        OP01[OP-01 Configure JWT Bearer options]
        OP11[OP-11 Select dual authentication scheme]
        OP14[OP-14 Register authentication services]
    end
    subgraph Declarative authorization
        OP02[OP-02 Resolve a SecurityAPI authorization policy]
        OP03[OP-03 Evaluate a SecurityApiRequirement]
    end
    subgraph Identity and remote checks
        OP12[OP-12 Resolve the current identity service]
        OP09["OP-09 Authorize current user, token"]
        OP10["OP-10 Authorize current user, Windows"]
        OP04[OP-04 Check role authorization remotely]
        OP15[OP-15 Handle a Security API response]
    end
    subgraph SecurityApi data lookups
        OP05[OP-05 Get user profile]
        OP06[OP-06 Get users by AD group]
        OP07[OP-07 Get application authorization groups]
        OP08[OP-08 Get external user]
    end
    subgraph Outbound credentialing
        OP13[OP-13 Acquire an outbound access token]
    end

    OP14 --> OP01
    OP14 --> OP02
    OP14 --> OP03
    OP11 --> OP12
    OP02 --> OP03
    OP03 --> OP04
    OP12 --> OP09
    OP12 --> OP10
    OP09 --> OP04
    OP10 --> OP04
    OP04 --> OP15
    OP05 --> OP15
    OP06 --> OP15
    OP07 --> OP15
    OP08 --> OP15

Related documentation

• Index
• Overview
• Architecture
• Dependencies
• Configuration
• Business rules
• Security and authorization
• Service registration
• API reference

Sources

• src/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/ConfigureJwtBearerOptions.cs
• src/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/Authorization/SecurityApiAuthorize.cs
• src/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/Authorization/SecurityAPIPolicy.cs
• src/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/Authorization/SecurityApiHandler.cs
• src/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/Clients/SecurityClient.cs
• src/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/Clients/OktaTokenClient.cs
• src/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/Identity/TokenIdentityService.cs
• src/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/Identity/WinIdentityService.cs
• src/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/Identity/MultiIdentityServiceAccessor.cs
• src/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/Identity/IdentityServiceAccessor.cs
• src/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/Extensions/AuthenticationServiceExtensions.cs