---
title: Apply service-account credentials
summary: Replace the ambient NTLM identity with an explicit service-account credential.
status: draft
owner: Framework.NCore maintainers
last_reviewed: 2026-10-02
library: SAIF.NetCore.DBConnectionClient
reference_type: package
operation_id: OP-DBC-02
trigger: Called by ServiceExtensions.RegisterDBConnectionClient after decrypting connectionservicecreds
---

# Apply service-account credentials

This operation switches the HTTP client's outbound NTLM identity from the ambient process account to an explicit service-account username and password, typically supplied by the host application after it decrypts a secure configuration setting.

| Field | Value |
| --- | --- |
| **Operation ID** | OP-DBC-02 |
| **Trigger** | Called by `ServiceExtensions.RegisterDBConnectionClient` immediately after it decrypts the `connectionservicecreds` secure setting |
| **Inputs** | `username`, `password` |
| **Outputs** | None (side effect only: NTLM credentials applied to the HTTP client) |
| **Primary components** | `ConnectionClient.SetupClientCredentials` |
| **Entry point** | `src/SAIF.NetCore.DbConnectionClient/SAIF.NetCore.DBConnectionClient/SAIF.NetCore.DBConnectionClient/ConnectionClient.cs` |

## Steps

1. Replace the current-identity NTLM configuration with explicit credentials: `HttpClient.SetNtlmAuthentication(username, password)` ([BR-DBC-03](../business-rules.md#br-dbc-03-ntlm-authentication%2C-defaulting-to-process-identity)).
   - 1.1. This library calls only `IHttpJsonClient.SetNtlmAuthentication(username, password)`; when the standard `HttpJsonClient` implementation is registered, that call builds an `NtlmAuthenticator` from the supplied `username`/`password` and stores it on the client instance as `_authenticator`, replacing the parameterless (current-identity) authenticator set during [Construct and configure the client](construct-and-configure-client.md). The stored authenticator is only assigned to a `RestClient` later, inside `CreateClient`, each time that implementation builds a new `RestClient` for an outbound request. A differently registered `IHttpJsonClient` implementation is not required to construct an `NtlmAuthenticator` or assign it the same way.

   > **Origin**: Step 1.1 is implemented in [Configure authentication](../../saif-netcore-httpclients/operations/configure-authentication.md) (`SAIF.NetCore.HttpClients`, `HttpJsonClient.SetNtlmAuthentication(string,string)`/`CreateClient`) when the standard `HttpJsonClient` implementation is registered, and executed on behalf of this operation.
   - Neither `username` nor `password` is validated before being passed through.

## Process flow

```mermaid
flowchart TD
	Start([SetupClientCredentials called]) --> Ntlm[SetNtlmAuthentication with explicit username/password]
	Ntlm --> Done([HTTP client now authenticates as service account])
```

## Failure and edge-case behavior
- No input validation: an empty or malformed `username`/`password` is passed straight to `IHttpJsonClient.SetNtlmAuthentication` without this library detecting the problem.
- Because `SetupClientCredentials` is `virtual`, a subclass can change or skip credential replacement entirely.

## Related documentation
- [Operations and processes](../operations-processes.md)
- [Business rules](../business-rules.md)

## Sources
- `src/SAIF.NetCore.DbConnectionClient/SAIF.NetCore.DBConnectionClient/SAIF.NetCore.DBConnectionClient/ConnectionClient.cs`
- `src/SAIF.NetCore.HttpClients/SAIF.NetCore.HttpClients/SAIF.NetCore.HttpClients/HttpJsonClient/HttpJsonClient.cs` (`SetNtlmAuthentication(string,string)`, `CreateClient` — collaborator detail reached when the standard `IHttpJsonClient` implementation is registered)