---
title: Convert the OnBehalfOfUser header into a claim
summary: Copies the inbound OnBehalfOfUser header onto the authenticated identity as a claim.
status: draft
owner: SAIF Platform Team
last_reviewed: 2026-10-02
library: SAIF.NetCore.NtlmApiAuth
reference_type: package
operation_id: OP-05
trigger: Every HTTP request
---

# Convert the OnBehalfOfUser header into a claim

Reads the `OnBehalfOfUser` request header and, if the caller is authenticated, adds it as a claim so later authorization steps can evaluate the delegated identity.

| Field | Value |
| --- | --- |
| **Operation ID** | OP-05 |
| **Trigger** | Every HTTP request |
| **Inputs** | `HttpContext.User`, request headers |
| **Outputs** | Claim added to the identity (side effect) |
| **Primary components** | `OnBehalfOfUserClaimMiddleware.InvokeAsync`, `OnBehalfOfUserClaimService.SetOnBehalfOfUserClaim` |
| **Entry point** | `src/SAIF.NetCore.NtlmApiAuth/src/SAIF.NetCore.NtlmApiAuth/Middleware/OnBehalfOfUserClaimMiddleware.cs` |

## Steps

1. Read `context.User` and `context.Request.Headers` (null-safe).
2. If headers contain `OnBehalfOfUser`, read its value (multiple values are joined by the `StringValues` → `string` conversion). ([BR-NTLM-001](../business-rules.md#br-ntlm-001-onbehalfofuser-header-and-claim))
3. If the value is null/whitespace, do nothing. ([BR-NTLM-001](../business-rules.md#br-ntlm-001-onbehalfofuser-header-and-claim))
   - If the value is present: continue to step 4.
4. If `User.Identity` is a `ClaimsIdentity` and `IsAuthenticated`, add `Claim("OnBehalfOfUser", value)`; otherwise ignore the header. ([BR-NTLM-002](../business-rules.md#br-ntlm-002-claim-only-added-for-authenticated-identities))
5. Always call `next(context)` — the middleware never short-circuits. ([BR-NTLM-003](../business-rules.md#br-ntlm-003-middleware-never-blocks))

## Process flow

```mermaid
flowchart TD
	Start([HTTP request]) --> S1[Read User and headers]
	S1 --> S2{OnBehalfOfUser header present and non-blank?}
	S2 -->|No| S5[next context]
	S2 -->|Yes| S3{Identity is authenticated ClaimsIdentity?}
	S3 -->|No| S5
	S3 -->|Yes| S4[Add OnBehalfOfUser claim]
	S4 --> S5
	S5 --> End([Pipeline continues])
```

## Failure and edge-case behavior
- A null `context.User` would throw on `.Identity` dereference; not expected under ASP.NET Core's own request pipeline.

## Related documentation
- [Operations and processes](../operations-processes.md)
- [Business rules](../business-rules.md)

## Sources
- `src/SAIF.NetCore.NtlmApiAuth/src/SAIF.NetCore.NtlmApiAuth/Middleware/OnBehalfOfUserClaimMiddleware.cs`
- `src/SAIF.NetCore.NtlmApiAuth/src/SAIF.NetCore.NtlmApiAuth/Services/OnBehalfOfUserClaimService.cs`