Skip to content

Apply service-account credentials

This operation switches the HTTP client's outbound NTLM identity from the ambient process account to an explicit service-account username and password, typically supplied by the host application after it decrypts a secure configuration setting.

Field Value
Operation ID OP-DBC-02
Trigger Called by ServiceExtensions.RegisterDBConnectionClient immediately after it decrypts the connectionservicecreds secure setting
Inputs username, password
Outputs None (side effect only: NTLM credentials applied to the HTTP client)
Primary components ConnectionClient.SetupClientCredentials
Entry point src/SAIF.NetCore.DbConnectionClient/SAIF.NetCore.DBConnectionClient/SAIF.NetCore.DBConnectionClient/ConnectionClient.cs

Steps

  1. Replace the current-identity NTLM configuration with explicit credentials: HttpClient.SetNtlmAuthentication(username, password) (BR-DBC-03).
  2. 1.1. This library calls only IHttpJsonClient.SetNtlmAuthentication(username, password); when the standard HttpJsonClient implementation is registered, that call builds an NtlmAuthenticator from the supplied username/password and stores it on the client instance as _authenticator, replacing the parameterless (current-identity) authenticator set during Construct and configure the client. The stored authenticator is only assigned to a RestClient later, inside CreateClient, each time that implementation builds a new RestClient for an outbound request. A differently registered IHttpJsonClient implementation is not required to construct an NtlmAuthenticator or assign it the same way.

Origin: Step 1.1 is implemented in Configure authentication (SAIF.NetCore.HttpClients, HttpJsonClient.SetNtlmAuthentication(string,string)/CreateClient) when the standard HttpJsonClient implementation is registered, and executed on behalf of this operation. - Neither username nor password is validated before being passed through.

Process flow

flowchart TD
    Start([SetupClientCredentials called]) --> Ntlm[SetNtlmAuthentication with explicit username/password]
    Ntlm --> Done([HTTP client now authenticates as service account])

Failure and edge-case behavior

  • No input validation: an empty or malformed username/password is passed straight to IHttpJsonClient.SetNtlmAuthentication without this library detecting the problem.
  • Because SetupClientCredentials is virtual, a subclass can change or skip credential replacement entirely.

Sources

  • src/SAIF.NetCore.DbConnectionClient/SAIF.NetCore.DBConnectionClient/SAIF.NetCore.DBConnectionClient/ConnectionClient.cs
  • src/SAIF.NetCore.HttpClients/SAIF.NetCore.HttpClients/SAIF.NetCore.HttpClients/HttpJsonClient/HttpJsonClient.cs (SetNtlmAuthentication(string,string), CreateClient — collaborator detail reached when the standard IHttpJsonClient implementation is registered)