Skip to content

Add the on-behalf-of middleware

Adds the factory-activated OnBehalfOfUserClaimMiddleware to the request pipeline so every request gets a chance to carry an OnBehalfOfUser claim before authorization runs.

Field Value
Operation ID OP-04
Trigger Consumer Configure (startup)
Inputs IApplicationBuilder
Outputs Middleware added to the pipeline
Primary components IApplicationBuilderExtensions.UseNtlmApiAuthorization()
Entry point src/SAIF.NetCore.NtlmApiAuth/src/SAIF.NetCore.NtlmApiAuth/Extensions/IApplicationBuilderExtensions.cs

Steps

  1. Call app.UseMiddleware<OnBehalfOfUserClaimMiddleware>() (factory-activated IMiddleware, requires the Scoped registration added by OP-01 step 5).

Process flow

flowchart TD
    Start([Configure]) --> S1[UseMiddleware OnBehalfOfUserClaimMiddleware]
    S1 --> End([Middleware added to pipeline])

Failure and edge-case behavior

  • Must run after the request identity is authenticated (IIS Windows auth sets it before the pipeline; otherwise it must follow UseAuthentication()), and before UseAuthorization()/endpoint execution, because the middleware only adds the claim to an already-authenticated identity.

Sources

  • src/SAIF.NetCore.NtlmApiAuth/src/SAIF.NetCore.NtlmApiAuth/Extensions/IApplicationBuilderExtensions.cs