This page captures business rules enforced by this library, including the rules governing the dual-identity authorization check that delegates part of its decision to SAIF.NetCore.AuthService's SecurityClient.IsAuthorized.
BR-NTLM-005 Request identity must itself be authorized¶
Field
Value
Statement
The calling (request) identity must itself be authorized for the role; if it is not, the on-behalf-of user is not evaluated.
Trigger
Requirement evaluation
Enforcement
NtlmApiAuthorizationService.IsAuthorized, which delegates to AuthService's SecurityClient.IsAuthorized(userId, role) — confirmed against the repository's 10.x source; applicability to the pinned 8.2023.319.2 package is inferred*
Outcome
Returns false without evaluating the on-behalf-of user
BR-NTLM-006 Both identities must pass when on-behalf-of user is present¶
Field
Value
Statement
When an on-behalf-of user is present, both identities must be authorized for the role; when absent, the request identity alone suffices.
Trigger
Requirement evaluation
Enforcement
NtlmApiAuthorizationService.IsAuthorized, which delegates to AuthService's SecurityClient.IsAuthorized(userId, role) for each identity — confirmed against the repository's 10.x source; applicability to the pinned 8.2023.319.2 package is inferred*
A policy built with AddPolicies(string policyName, params string[] roles) contains one requirement per role; every requirement must succeed, and any failing RoleRequirement calls context.Fail(), so multi-role policies behave as AND, contradicting the README's OR description.*
context.Fail() for the authorization requirement unless every per-role RoleRequirement succeeds; ASP.NET Core's authorization middleware and the host then translate an overall-failed authorization result into the actual response (typically 403, but this is a framework/host behavior, not something this library sets directly)*
BR-NTLM-008 SecurityAPI failures fail closed via exception¶
Field
Value
Statement
A SecurityAPI failure is not treated as "not authorized"; SecurityClientException propagates out of the handler to the caller.
Trigger
Remote call failure
Enforcement
RoleRequirement.HandleRequirementAsync (no try/catch); originates in AuthService's SecurityClient.HandleSecurityServiceGetResponse<T> — confirmed against the repository's 10.x source; applicability to the pinned 8.2023.319.2 package is inferred*
Outcome
The uncaught exception propagates out of HandleRequirementAsync to whatever invoked authorization (typically ASP.NET Core's authorization middleware); the resulting HTTP response is produced by that caller/host's own exception handling, not by this library*
Configuring a client for on-behalf-of authorization enables header persistence, so the user header is sent on every request made by that client instance, and resets other client options to defaults.
User names are normalized by removing a DOMAIN\ prefix and an @domain suffix (only when the separator index is greater than 1). Applied to the request user on the server and, by default, to the outbound user name on the client.
Trigger
Name extraction
Enforcement
StringExtensions.DomainlessUser; called from RoleRequirement, MvcCurrentUserService, BlazorCurrentUserService
BR-NTLM-012 Policies defined by subclassing ConfigureRoleAuthorizationOptions¶
Field
Value
Statement
Policies are defined in code by subclassing ConfigureRoleAuthorizationOptions and overriding SetPolicies; each role becomes a SecurityAPI-backed requirement.
A public, unwired utility converts an AD resource group to its environment counterpart by replacing a trailing resource with the supplied suffix, or appending the suffix if absent.*
BR-NTLM-016 Environment role-suffix rewrite and domain separator normalization¶
Field
Value
Statement
Role names are rewritten for the environment (a role name ending in the literal resource has that trailing token replaced with the configured resourcesuffix value) and the user's \ is replaced with / before every SecurityAPI call made on behalf of this library. This was confirmed by inspecting the repository's 10.x SecurityClient source; applicability to the pinned 8.2023.319.2 package version consumed by this library is inferred*.
Trigger
Each ISecurityClient.IsAuthorized call reached from NtlmApiAuthorizationService
BR-NTLM-005, BR-NTLM-006, BR-NTLM-008, and BR-NTLM-016 describe behavior partly implemented in SAIF.NetCore.AuthService's SecurityClient.IsAuthorized, reached transitively from NtlmApiAuthorizationService.IsAuthorized (see Dependencies for the full call-chain citation); they are retained here because they determine the outcome of this library's own authorization decision. This same-repository AuthService behavior was confirmed by inspecting the repository's 10.x SecurityClient source; its applicability to the 8.2023.319.2 package version actually pinned by this library is inferred*.
Note: Statements marked with * were inferred from code structure, naming
conventions, or contextual evidence where direct confirmation was not available
in source artifacts.