---
title: SAIF.NetCore.NtlmApiAuth operations and processes
summary: Business and technical operations supported by this library.
status: draft
owner: SAIF Platform Team
last_reviewed: 2026-10-02
library: SAIF.NetCore.NtlmApiAuth
reference_type: package
---

# SAIF.NetCore.NtlmApiAuth operations and processes

This page is the operation catalog and cross-operation hub for this library. Each operation's detailed, step-by-step logic lives in its own page under `operations/`. No operation reads or writes a database table or SQL statement (see [Dependencies](dependencies.md)); OP-06 and OP-07 delegate part of their decision to `SAIF.NetCore.AuthService`'s `SecurityClient.IsAuthorized`, traced inline in their detail pages.

## Operation catalog
| Operation | Intent | Trigger | Inputs | Outputs | Rules |
| --- | --- | --- | --- | --- | --- |
| [Register server-side NTLM API authorization](operations/register-server-side-authorization.md) | Wire up policies, middleware, and the authorization service | Consumer `ConfigureServices` | `IServiceCollection`, consumer `ConfigureRoleAuthorizationOptions` subclass | Registered services | [BR-NTLM-012](business-rules.md#br-ntlm-012-policies-defined-by-subclassing-configureroleauthorizationoptions) |
| [Build named role policies](operations/build-named-role-policies.md) | Turn consumer-declared roles into authorization policies | First resolution of `IOptions<AuthorizationOptions>` | Consumer `SetPolicies()` override | `AuthorizationOptions` with named policies | [BR-NTLM-007](business-rules.md#br-ntlm-007-multi-role-policies-are-and), [BR-NTLM-012](business-rules.md#br-ntlm-012-policies-defined-by-subclassing-configureroleauthorizationoptions) |
| [Register client-side services](operations/register-client-side-services.md) | Register the current-user resolver for a client app | Consumer `ConfigureServices` | `ClientAppType` | `ICurrentUserService` registration | [BR-NTLM-013](business-rules.md#br-ntlm-013-current-user-source-depends-on-client-type) |
| [Add the on-behalf-of middleware](operations/add-on-behalf-of-middleware.md) | Wire the header→claim middleware into the pipeline | Consumer `Configure` | `IApplicationBuilder` | Middleware added to pipeline | — |
| [Convert the OnBehalfOfUser header into a claim](operations/convert-header-to-claim.md) | Make the delegated user available as a claim for authorization | Every HTTP request | `HttpContext.User`, request headers | Claim added (side effect) | [BR-NTLM-001](business-rules.md#br-ntlm-001-onbehalfofuser-header-and-claim), [BR-NTLM-002](business-rules.md#br-ntlm-002-claim-only-added-for-authenticated-identities), [BR-NTLM-003](business-rules.md#br-ntlm-003-middleware-never-blocks) |
| [Evaluate a role requirement](operations/evaluate-role-requirement.md) | Decide whether a single role requirement succeeds | ASP.NET Core authorization for a policy built by OP-02 | `AuthorizationHandlerContext`, `RoleRequirement` | `Succeed`/`Fail` on the context | [BR-NTLM-004](business-rules.md#br-ntlm-004-blank-request-identity-is-never-authorized), [BR-NTLM-007](business-rules.md#br-ntlm-007-multi-role-policies-are-and), [BR-NTLM-008](business-rules.md#br-ntlm-008-securityapi-failures-fail-closed-via-exception), [BR-NTLM-011](business-rules.md#br-ntlm-011-user-name-normalization) |
| [Dual-identity authorization](operations/dual-identity-authorization.md) | Authorize the request user and, if present, the on-behalf-of user | Called from OP-06 | Request user, on-behalf-of user, role | `bool` | [BR-NTLM-004](business-rules.md#br-ntlm-004-blank-request-identity-is-never-authorized), [BR-NTLM-005](business-rules.md#br-ntlm-005-request-identity-must-itself-be-authorized), [BR-NTLM-006](business-rules.md#br-ntlm-006-both-identities-must-pass-when-on-behalf-of-user-is-present), [BR-NTLM-016](business-rules.md#br-ntlm-016-environment-role-suffix-rewrite-and-domain-separator-normalization) |
| [Get the current user name](operations/get-current-user-name.md) | Resolve the current user's name for client-side use | Called by OP-09 or directly by consumer code | `friendlyName` flag | User name or `null` | [BR-NTLM-011](business-rules.md#br-ntlm-011-user-name-normalization), [BR-NTLM-013](business-rules.md#br-ntlm-013-current-user-source-depends-on-client-type) |
| [Configure an outbound client to send OnBehalfOfUser](operations/configure-outbound-client-header.md) | Attach the delegated-user header to every request from a client | Consumer client setup code | `ICurrentUserService` | `IHttpJsonClient` reconfigured | [BR-NTLM-009](business-rules.md#br-ntlm-009-header-configuration-enables-persistence), [BR-NTLM-010](business-rules.md#br-ntlm-010-header-added-only-when-non-blank%3B-duplicate-add-throws) |
| [Forward the inbound OnBehalfOfUser header](operations/forward-inbound-header.md) | Relay the delegated user to a downstream API call | API-to-API call | Inbound claim, target `IHttpJsonClient` | Header added to the next request | [BR-NTLM-001](business-rules.md#br-ntlm-001-onbehalfofuser-header-and-claim), [BR-NTLM-010](business-rules.md#br-ntlm-010-header-added-only-when-non-blank%3B-duplicate-add-throws) |
| [Expose the header in Swagger UI when debugging](operations/expose-header-in-swagger.md) | Let a developer supply the header from Swagger UI | Swagger configuration (startup) | `Debugger.IsAttached` | Operation filter registered | [BR-NTLM-014](business-rules.md#br-ntlm-014-swagger-header-only-shown-when-debugging) |
| [Rewrite a resource group for the environment](operations/rewrite-resource-group-for-environment.md) | Public utility to append an environment suffix to a resource name (not wired into any live call) | Caller-invoked | Resource name, suffix | Rewritten resource name | [BR-NTLM-015](business-rules.md#br-ntlm-015-authorizationresource-suffix-rewrite-%E2%80%94-unwired-utility) |

## Process flow diagram
The following diagram visualizes the primary server-side request flow, including the delegated AuthService check.

```mermaid
flowchart TD
	Start([HTTP request]) --> Mid[OnBehalfOfUserClaimMiddleware adds claim if authenticated]
	Mid --> Authz[Authorization policy evaluated]
	Authz --> Req[RoleRequirement.HandleRequirementAsync]
	Req --> Svc[NtlmApiAuthorizationService.IsAuthorized]
	Svc --> Caller{Request user authorized?}
	Caller -->|No| Fail([context.Fail])
	Caller -->|Yes| OBO{On-behalf-of user present?}
	OBO -->|No| Succeed([context.Succeed])
	OBO -->|Yes| OBOCheck{On-behalf-of user authorized?}
	OBOCheck -->|No| Fail
	OBOCheck -->|Yes| Succeed
```

## Failure and edge-case behavior
- A `SecurityClientException` from AuthService's `SecurityClient` propagates out of `RoleRequirement.HandleRequirementAsync` uncaught to the host; the resulting HTTP response is governed by the host's own error-handling configuration and is inferred to be a server error rather than a 403 ([BR-NTLM-008](business-rules.md#br-ntlm-008-securityapi-failures-fail-closed-via-exception))*.
- Calling `ConfigureOnBehalfOfUserAuthorization` or `ForwardOnBehalfOfUserHeader` twice on the same persisted client throws `ArgumentException` from the underlying `Headers.Add` call ([BR-NTLM-010](business-rules.md#br-ntlm-010-header-added-only-when-non-blank%3B-duplicate-add-throws)).
- `DomainlessUser` can throw `ArgumentOutOfRangeException` for unusual short name formats (see [Architecture](architecture.md) design constraints).

## Related documentation
- [Index](index.md)
- [Overview](overview.md)
- [Architecture](architecture.md)
- [Dependencies](dependencies.md)
- [Business rules](business-rules.md)
- [Security and authorization](security-authorization.md)
- [Service registration](service-registration.md)
- [API reference](api/index.md)

> **Note:** Statements marked with `*` were inferred from code structure, naming
> conventions, or contextual evidence where direct confirmation was not available
> in source artifacts.

## Sources
- `src/SAIF.NetCore.NtlmApiAuth/src/SAIF.NetCore.NtlmApiAuth/Extensions/IServiceCollectionExtensions.cs`
- `src/SAIF.NetCore.NtlmApiAuth/src/SAIF.NetCore.NtlmApiAuth/Options/ConfigureRoleAuthorizationOptions.cs`
- `src/SAIF.NetCore.NtlmApiAuth/src/SAIF.NetCore.NtlmApiAuth/Extensions/IApplicationBuilderExtensions.cs`
- `src/SAIF.NetCore.NtlmApiAuth/src/SAIF.NetCore.NtlmApiAuth/Middleware/OnBehalfOfUserClaimMiddleware.cs`
- `src/SAIF.NetCore.NtlmApiAuth/src/SAIF.NetCore.NtlmApiAuth/Authorization/RoleRequirement.cs`
- `src/SAIF.NetCore.NtlmApiAuth/src/SAIF.NetCore.NtlmApiAuth/Services/NtmlApiAuthorizationService.cs`
- `src/SAIF.NetCore.NtlmApiAuth/src/SAIF.NetCore.NtlmApiAuth/Services/MvcCurrentUserService.cs`, `Services/BlazorCurrentUserService.cs`
- `src/SAIF.NetCore.NtlmApiAuth/src/SAIF.NetCore.NtlmApiAuth/Extensions/IHttpJsonClientExtensions.cs`, `Extensions/HttpContextAccessorExtensions.cs`
- `src/SAIF.NetCore.NtlmApiAuth/src/SAIF.NetCore.NtlmApiAuth/Extensions/SwaggerGenOptionsExtensions.cs`
- `src/SAIF.NetCore.NtlmApiAuth/src/SAIF.NetCore.NtlmApiAuth/Extensions/StringExtensions.cs`