Skip to content

Resolve the current identity service

Resolves which concrete IIdentityService implementation represents the current user, switching on the authentication scheme when multiple identity services are registered.

Security enforcement points: EP-09 (identity selection).

Field Value
Operation ID OP-12
Trigger Consumer code resolves IIdentityServiceAccessor.IdentityService from DI.
Inputs The current HttpContext (may be null), the registered identity services.
Outputs An IIdentityService instance (TokenIdentityService or WinIdentityService, or whatever is registered for the single-accessor case).
Primary components MultiIdentityServiceAccessor.IdentityService / IdentityServiceAccessor.IdentityService
Entry point src/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/Identity/MultiIdentityServiceAccessor.cs

Steps

  1. Multi: the scheme is AuthenticationSchemeSelector(HttpContext) — or the IIS scheme if HttpContext is null (BR-AUTH-016)
  2. AuthenticationSchemeSelector is a mutable static Func<HttpContext, string> field on AuthenticationServiceExtensions; its default implementation returns the JwtBearer scheme when the Authorization request header starts with "Bearer ", and the IIS/Windows scheme otherwise.

Origin: Step 1's scheme-selection logic is implemented in Select the dual authentication scheme (SAIF.NetCore.AuthService) and executed on behalf of this operation. 2. For the JwtBearer scheme, resolve TokenIdentityService; for any other scheme, resolve WinIdentityService. 3. Single: IdentityServiceAccessor is constructed with an IServiceProvider and an IHttpContextAccessor, which it stores; it does not resolve or cache IIdentityService in its constructor. Each access of its IdentityService getter calls ServiceProvider.GetService(typeof(IIdentityService)) fresh — a service-location call, not a captured/injected instance — so the returned implementation depends on whichever IIdentityService registration (AddTokenIdentityService or AddWinIdentityService) and DI lifetime the consumer configured; there is no scheme switching on this path.

Process flow

The following diagram visualizes this operation's control flow.

flowchart TD
    Start([IdentityService resolved]) --> HasCtx{HttpContext present?}
    HasCtx -->|No| Win([Resolve WinIdentityService])
    HasCtx -->|Yes| Scheme[AuthenticationSchemeSelector HttpContext]
    Scheme --> IsJwt{JwtBearer scheme?}
    IsJwt -->|Yes| Token([Resolve TokenIdentityService])
    IsJwt -->|No| Win2([Resolve WinIdentityService])

Failure and edge-case behavior

  • With no HttpContext, the multi accessor defaults to WinIdentityService, whose UserId is then null and throws NullReferenceException on the next authorization call*.

Note: Statements marked with * were inferred from code structure, naming conventions, or contextual evidence where direct confirmation was not available in source artifacts. Statements marked with ** could not be confirmed; treat as unknown until verified.

Sources

  • src/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/Identity/MultiIdentityServiceAccessor.cs
  • src/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/Identity/IdentityServiceAccessor.cs