Skip to content

SAIF.NetCore.NtlmApiAuth operations and processes

This page is the operation catalog and cross-operation hub for this library. Each operation's detailed, step-by-step logic lives in its own page under operations/. No operation reads or writes a database table or SQL statement (see Dependencies); OP-06 and OP-07 delegate part of their decision to SAIF.NetCore.AuthService's SecurityClient.IsAuthorized, traced inline in their detail pages.

Operation catalog

Operation Intent Trigger Inputs Outputs Rules
Register server-side NTLM API authorization Wire up policies, middleware, and the authorization service Consumer ConfigureServices IServiceCollection, consumer ConfigureRoleAuthorizationOptions subclass Registered services BR-NTLM-012
Build named role policies Turn consumer-declared roles into authorization policies First resolution of IOptions<AuthorizationOptions> Consumer SetPolicies() override AuthorizationOptions with named policies BR-NTLM-007, BR-NTLM-012
Register client-side services Register the current-user resolver for a client app Consumer ConfigureServices ClientAppType ICurrentUserService registration BR-NTLM-013
Add the on-behalf-of middleware Wire the header→claim middleware into the pipeline Consumer Configure IApplicationBuilder Middleware added to pipeline —
Convert the OnBehalfOfUser header into a claim Make the delegated user available as a claim for authorization Every HTTP request HttpContext.User, request headers Claim added (side effect) BR-NTLM-001, BR-NTLM-002, BR-NTLM-003
Evaluate a role requirement Decide whether a single role requirement succeeds ASP.NET Core authorization for a policy built by OP-02 AuthorizationHandlerContext, RoleRequirement Succeed/Fail on the context BR-NTLM-004, BR-NTLM-007, BR-NTLM-008, BR-NTLM-011
Dual-identity authorization Authorize the request user and, if present, the on-behalf-of user Called from OP-06 Request user, on-behalf-of user, role bool BR-NTLM-004, BR-NTLM-005, BR-NTLM-006, BR-NTLM-016
Get the current user name Resolve the current user's name for client-side use Called by OP-09 or directly by consumer code friendlyName flag User name or null BR-NTLM-011, BR-NTLM-013
Configure an outbound client to send OnBehalfOfUser Attach the delegated-user header to every request from a client Consumer client setup code ICurrentUserService IHttpJsonClient reconfigured BR-NTLM-009, BR-NTLM-010
Forward the inbound OnBehalfOfUser header Relay the delegated user to a downstream API call API-to-API call Inbound claim, target IHttpJsonClient Header added to the next request BR-NTLM-001, BR-NTLM-010
Expose the header in Swagger UI when debugging Let a developer supply the header from Swagger UI Swagger configuration (startup) Debugger.IsAttached Operation filter registered BR-NTLM-014
Rewrite a resource group for the environment Public utility to append an environment suffix to a resource name (not wired into any live call) Caller-invoked Resource name, suffix Rewritten resource name BR-NTLM-015

Process flow diagram

The following diagram visualizes the primary server-side request flow, including the delegated AuthService check.

flowchart TD
    Start([HTTP request]) --> Mid[OnBehalfOfUserClaimMiddleware adds claim if authenticated]
    Mid --> Authz[Authorization policy evaluated]
    Authz --> Req[RoleRequirement.HandleRequirementAsync]
    Req --> Svc[NtlmApiAuthorizationService.IsAuthorized]
    Svc --> Caller{Request user authorized?}
    Caller -->|No| Fail([context.Fail])
    Caller -->|Yes| OBO{On-behalf-of user present?}
    OBO -->|No| Succeed([context.Succeed])
    OBO -->|Yes| OBOCheck{On-behalf-of user authorized?}
    OBOCheck -->|No| Fail
    OBOCheck -->|Yes| Succeed

Failure and edge-case behavior

  • A SecurityClientException from AuthService's SecurityClient propagates out of RoleRequirement.HandleRequirementAsync uncaught to the host; the resulting HTTP response is governed by the host's own error-handling configuration and is inferred to be a server error rather than a 403 (BR-NTLM-008)*.
  • Calling ConfigureOnBehalfOfUserAuthorization or ForwardOnBehalfOfUserHeader twice on the same persisted client throws ArgumentException from the underlying Headers.Add call (BR-NTLM-010).
  • DomainlessUser can throw ArgumentOutOfRangeException for unusual short name formats (see Architecture design constraints).

Note: Statements marked with * were inferred from code structure, naming conventions, or contextual evidence where direct confirmation was not available in source artifacts.

Sources

  • src/SAIF.NetCore.NtlmApiAuth/src/SAIF.NetCore.NtlmApiAuth/Extensions/IServiceCollectionExtensions.cs
  • src/SAIF.NetCore.NtlmApiAuth/src/SAIF.NetCore.NtlmApiAuth/Options/ConfigureRoleAuthorizationOptions.cs
  • src/SAIF.NetCore.NtlmApiAuth/src/SAIF.NetCore.NtlmApiAuth/Extensions/IApplicationBuilderExtensions.cs
  • src/SAIF.NetCore.NtlmApiAuth/src/SAIF.NetCore.NtlmApiAuth/Middleware/OnBehalfOfUserClaimMiddleware.cs
  • src/SAIF.NetCore.NtlmApiAuth/src/SAIF.NetCore.NtlmApiAuth/Authorization/RoleRequirement.cs
  • src/SAIF.NetCore.NtlmApiAuth/src/SAIF.NetCore.NtlmApiAuth/Services/NtmlApiAuthorizationService.cs
  • src/SAIF.NetCore.NtlmApiAuth/src/SAIF.NetCore.NtlmApiAuth/Services/MvcCurrentUserService.cs, Services/BlazorCurrentUserService.cs
  • src/SAIF.NetCore.NtlmApiAuth/src/SAIF.NetCore.NtlmApiAuth/Extensions/IHttpJsonClientExtensions.cs, Extensions/HttpContextAccessorExtensions.cs
  • src/SAIF.NetCore.NtlmApiAuth/src/SAIF.NetCore.NtlmApiAuth/Extensions/SwaggerGenOptionsExtensions.cs
  • src/SAIF.NetCore.NtlmApiAuth/src/SAIF.NetCore.NtlmApiAuth/Extensions/StringExtensions.cs