---
title: Add the on-behalf-of middleware
summary: Wires OnBehalfOfUserClaimMiddleware into the ASP.NET Core request pipeline.
status: draft
owner: SAIF Platform Team
last_reviewed: 2026-10-02
library: SAIF.NetCore.NtlmApiAuth
reference_type: package
operation_id: OP-04
trigger: Consumer Configure (startup)
---

# Add the on-behalf-of middleware

Adds the factory-activated `OnBehalfOfUserClaimMiddleware` to the request pipeline so every request gets a chance to carry an `OnBehalfOfUser` claim before authorization runs.

| Field | Value |
| --- | --- |
| **Operation ID** | OP-04 |
| **Trigger** | Consumer `Configure` (startup) |
| **Inputs** | `IApplicationBuilder` |
| **Outputs** | Middleware added to the pipeline |
| **Primary components** | `IApplicationBuilderExtensions.UseNtlmApiAuthorization()` |
| **Entry point** | `src/SAIF.NetCore.NtlmApiAuth/src/SAIF.NetCore.NtlmApiAuth/Extensions/IApplicationBuilderExtensions.cs` |

## Steps

1. Call `app.UseMiddleware<OnBehalfOfUserClaimMiddleware>()` (factory-activated `IMiddleware`, requires the Scoped registration added by OP-01 step 5).

## Process flow

```mermaid
flowchart TD
	Start([Configure]) --> S1[UseMiddleware OnBehalfOfUserClaimMiddleware]
	S1 --> End([Middleware added to pipeline])
```

## Failure and edge-case behavior
- Must run after the request identity is authenticated (IIS Windows auth sets it before the pipeline; otherwise it must follow `UseAuthentication()`), and before `UseAuthorization()`/endpoint execution, because the middleware only adds the claim to an already-authenticated identity.

## Related documentation
- [Operations and processes](../operations-processes.md)
- [Business rules](../business-rules.md)

## Sources
- `src/SAIF.NetCore.NtlmApiAuth/src/SAIF.NetCore.NtlmApiAuth/Extensions/IApplicationBuilderExtensions.cs`