---
title: Resolve the current identity service
summary: Resolves which concrete `IIdentityService` implementation represents the current user, switching on the authentication scheme when multiple identity services are registered.
status: draft
owner: Framework.NCore maintainers
last_reviewed: 2026-10-02
library: SAIF.NetCore.AuthService
reference_type: package
operation_id: OP-12
trigger: Consumer code resolves `IIdentityServiceAccessor.IdentityService` from DI.
---

# Resolve the current identity service

Resolves which concrete `IIdentityService` implementation represents the current user, switching on the authentication scheme when multiple identity services are registered.

Security enforcement points: [EP-09 (identity selection)](../security-authorization.md#programmatic-authorization-checks).

| Field | Value |
| --- | --- |
| **Operation ID** | OP-12 |
| **Trigger** | Consumer code resolves `IIdentityServiceAccessor.IdentityService` from DI. |
| **Inputs** | The current `HttpContext` (may be null), the registered identity services. |
| **Outputs** | An `IIdentityService` instance (`TokenIdentityService` or `WinIdentityService`, or whatever is registered for the single-accessor case). |
| **Primary components** | `MultiIdentityServiceAccessor.IdentityService` / `IdentityServiceAccessor.IdentityService` |
| **Entry point** | `src/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/Identity/MultiIdentityServiceAccessor.cs` |

## Steps

1. Multi: the scheme is `AuthenticationSchemeSelector(HttpContext)` — or the IIS scheme if `HttpContext` is null ([BR-AUTH-016](../business-rules.md#br-auth-016-no-httpcontext-defaults-the-multi-accessor-to-windows))
   - `AuthenticationSchemeSelector` is a mutable static `Func<HttpContext, string>` field on `AuthenticationServiceExtensions`; its default implementation returns the JwtBearer scheme when the `Authorization` request header starts with `"Bearer "`, and the IIS/Windows scheme otherwise.

   > **Origin**: Step 1's scheme-selection logic is implemented in [Select the dual authentication scheme](select-dual-authentication-scheme.md) (`SAIF.NetCore.AuthService`) and executed on behalf of this operation.
2. For the JwtBearer scheme, resolve `TokenIdentityService`; for any other scheme, resolve `WinIdentityService`.
3. Single: `IdentityServiceAccessor` is constructed with an `IServiceProvider` and an `IHttpContextAccessor`, which it stores; it does not resolve or cache `IIdentityService` in its constructor. Each access of its `IdentityService` getter calls `ServiceProvider.GetService(typeof(IIdentityService))` fresh — a service-location call, not a captured/injected instance — so the returned implementation depends on whichever `IIdentityService` registration (`AddTokenIdentityService` or `AddWinIdentityService`) and DI lifetime the consumer configured; there is no scheme switching on this path.

## Process flow

The following diagram visualizes this operation's control flow.

```mermaid
flowchart TD
    Start([IdentityService resolved]) --> HasCtx{HttpContext present?}
    HasCtx -->|No| Win([Resolve WinIdentityService])
    HasCtx -->|Yes| Scheme[AuthenticationSchemeSelector HttpContext]
    Scheme --> IsJwt{JwtBearer scheme?}
    IsJwt -->|Yes| Token([Resolve TokenIdentityService])
    IsJwt -->|No| Win2([Resolve WinIdentityService])
```

## Failure and edge-case behavior

- With no `HttpContext`, the multi accessor defaults to `WinIdentityService`, whose `UserId` is then null and throws `NullReferenceException` on the next authorization call*.

## Related documentation
- [Operations and processes](../operations-processes.md)
- [Business rules](../business-rules.md)
- [Security and authorization](../security-authorization.md)

> **Note:** Statements marked with `*` were inferred from code structure, naming
> conventions, or contextual evidence where direct confirmation was not available
> in source artifacts. Statements marked with `**` could not be confirmed; treat
> as unknown until verified.

## Sources
- `src/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/Identity/MultiIdentityServiceAccessor.cs`
- `src/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/Identity/IdentityServiceAccessor.cs`