---
title: Select the dual authentication scheme
summary: Selects which concrete authentication scheme handles an incoming request under the `"dual"` policy scheme, based on the `Authorization` header.
status: draft
owner: Framework.NCore maintainers
last_reviewed: 2026-10-02
library: SAIF.NetCore.AuthService
reference_type: package
operation_id: OP-11
trigger: The `"dual"` policy scheme (registered by `AddDualAuthentication`) needs to forward an incoming request to a concrete authentication handler.
---

# Select the dual authentication scheme

Selects which concrete authentication scheme handles an incoming request under the `"dual"` policy scheme, based on the `Authorization` header.

| Field | Value |
| --- | --- |
| **Operation ID** | OP-11 |
| **Trigger** | The `"dual"` policy scheme (registered by `AddDualAuthentication`) needs to forward an incoming request to a concrete authentication handler. |
| **Inputs** | The current `HttpContext` and its `Authorization` request header. |
| **Outputs** | `JwtBearerDefaults.AuthenticationScheme` or `IISServerDefaults.AuthenticationScheme`. |
| **Primary components** | `AuthenticationServiceExtensions.AuthenticationSchemeSelector` |
| **Entry point** | `src/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/Extensions/AuthenticationServiceExtensions.cs` |

## Steps

1. Read the `Authorization` request header value.
2. If it starts with the literal `"Bearer "` (case-sensitive, trailing space), return `JwtBearerDefaults.AuthenticationScheme`; otherwise return `IISServerDefaults.AuthenticationScheme` ([BR-AUTH-015](../business-rules.md#br-auth-015-authorization-header-prefix-selects-the-dual-authentication-scheme))
   - Used by the `"dual"` policy scheme's `ForwardDefaultSelector` and by `MultiIdentityServiceAccessor` — see [Resolve the current identity service](resolve-the-current-identity-service.md) (OP-12).

## Process flow

The following diagram visualizes this operation's control flow.

```mermaid
flowchart TD
    Start([Request arrives under dual scheme]) --> Header[Read Authorization header]
    Header --> Check{"Starts with Bearer prefix?"}
    Check -->|Yes| Jwt([Forward to JwtBearer scheme])
    Check -->|No| Iis([Forward to IIS/Windows scheme])
```

## Failure and edge-case behavior

- `AuthenticationSchemeSelector` is a `public static` mutable field — any consumer can reassign it, changing scheme selection process-wide*.

## Related documentation
- [Operations and processes](../operations-processes.md)
- [Business rules](../business-rules.md)

> **Note:** Statements marked with `*` were inferred from code structure, naming
> conventions, or contextual evidence where direct confirmation was not available
> in source artifacts. Statements marked with `**` could not be confirmed; treat
> as unknown until verified.

## Sources
- `src/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/Extensions/AuthenticationServiceExtensions.cs`