---
title: SAIF.NetCore.LegacyAuth overview
summary: High-level purpose, scope, and responsibilities for this library.
status: draft
owner: Framework
last_reviewed: 2026-10-02
library: SAIF.NetCore.LegacyAuth
reference_type: package
---

# SAIF.NetCore.LegacyAuth overview

> **Documentation context:** Packaged Component (NuGet)

SAIF.NetCore.LegacyAuth is a small implementation-layer package that lets an ASP.NET Core application issue the legacy `SAIFAUTH` credential cookie — the user's name and password, DPAPI-encrypted with the Windows machine key and the client's remote IP address as entropy — so that a legacy .NET Framework component referred to in source as "SecurityModule" can authenticate the user on the same host.

## Purpose
- Build a tab-delimited `user`/`password` payload and encrypt it with the Windows Data Protection API (DPAPI), scoped to the local machine key and bound to the client's remote IP address as entropy, then write it as the `SAIFAUTH` response cookie for a legacy .NET Framework reader to decrypt.
- Provide a matching `ClearCookie` operation to remove the `SAIFAUTH` cookie, and a reusable `DPAPI` P/Invoke wrapper over the native `crypt32.dll` encrypt surface that consumers can use independently of the cookie service.
- Act purely as a credential-transport bridge between a modern login flow (inferred to be OIDC-based*, per an excluded source comment referencing "OnlineLogin") and legacy Framework sites — it never reads or validates a request cookie, so it has no authentication or authorization enforcement role of its own.
- There is no consumer of this package anywhere in this repository; its only known in-repo relationship is the shared `SAIFAUTH` cookie-name convention with `LegacyBolAuthMiddleware` in `SAIF.NetCore.ServiceExtensions`, which checks presence only and does not reference this package or decrypt the value.

## Responsibilities
- Encrypt and issue the `SAIFAUTH` legacy authentication cookie on behalf of a consuming application.
- Clear the `SAIFAUTH` cookie on logout or equivalent consumer-initiated action.
- Expose a general-purpose DPAPI encrypt wrapper and its supporting Win32 interop types for direct consumer use.

## Key components
- `ILegacyAuthCookieService` / `LegacyAuthCookieService`: builds the credential payload, encrypts it with DPAPI, and writes or deletes the `Set-Cookie: SAIFAUTH` header.
- `DPAPI`: a self-contained P/Invoke wrapper over `CryptProtectData`/`CryptUnprotectData`, with UTF-8 + Base64 string helpers; the public surface includes both raw native encrypt/decrypt externs, while only the managed `Decrypt` string/byte helper overloads are internal and unused by any consumer in this repository.
- `KeyType`, `DATA_BLOB`, `CRYPTPROTECT_PROMPTSTRUCT`: the supporting enum and Win32 interop structs used internally by `DPAPI`.

## Related documentation
- [Index](index.md)
- [Architecture](architecture.md)
- [Dependencies](dependencies.md)
- [Operations and processes](operations-processes.md)
- [Business rules](business-rules.md)
- [Security and authorization](security-authorization.md)
- [API reference](api/index.md)

> **Note:** Statements marked with `*` were inferred from code structure, naming
> conventions, or contextual evidence where direct confirmation was not available
> in source artifacts.

## Sources
- `src/SAIF.NetCore.LegacyAuth/src/SAIF.NetCore.LegacyAuth/SAIF.NetCore.LegacyAuth/SAIF.NetCore.LegacyAuth.csproj`
- `src/SAIF.NetCore.LegacyAuth/src/SAIF.NetCore.LegacyAuth/SAIF.NetCore.LegacyAuth/ILegacyAuthCookieService.cs`
- `src/SAIF.NetCore.LegacyAuth/src/SAIF.NetCore.LegacyAuth/SAIF.NetCore.LegacyAuth/LegacyAuthCookieService.cs`
- `src/SAIF.NetCore.LegacyAuth/src/SAIF.NetCore.LegacyAuth/SAIF.NetCore.LegacyAuth/DPAPI.cs`