Skip to content

Convert the OnBehalfOfUser header into a claim

Reads the OnBehalfOfUser request header and, if the caller is authenticated, adds it as a claim so later authorization steps can evaluate the delegated identity.

Field Value
Operation ID OP-05
Trigger Every HTTP request
Inputs HttpContext.User, request headers
Outputs Claim added to the identity (side effect)
Primary components OnBehalfOfUserClaimMiddleware.InvokeAsync, OnBehalfOfUserClaimService.SetOnBehalfOfUserClaim
Entry point src/SAIF.NetCore.NtlmApiAuth/src/SAIF.NetCore.NtlmApiAuth/Middleware/OnBehalfOfUserClaimMiddleware.cs

Steps

  1. Read context.User and context.Request.Headers (null-safe).
  2. If headers contain OnBehalfOfUser, read its value (multiple values are joined by the StringValues → string conversion). (BR-NTLM-001)
  3. If the value is null/whitespace, do nothing. (BR-NTLM-001)
  4. If the value is present: continue to step 4.
  5. If User.Identity is a ClaimsIdentity and IsAuthenticated, add Claim("OnBehalfOfUser", value); otherwise ignore the header. (BR-NTLM-002)
  6. Always call next(context) — the middleware never short-circuits. (BR-NTLM-003)

Process flow

flowchart TD
    Start([HTTP request]) --> S1[Read User and headers]
    S1 --> S2{OnBehalfOfUser header present and non-blank?}
    S2 -->|No| S5[next context]
    S2 -->|Yes| S3{Identity is authenticated ClaimsIdentity?}
    S3 -->|No| S5
    S3 -->|Yes| S4[Add OnBehalfOfUser claim]
    S4 --> S5
    S5 --> End([Pipeline continues])

Failure and edge-case behavior

  • A null context.User would throw on .Identity dereference; not expected under ASP.NET Core's own request pipeline.

Sources

  • src/SAIF.NetCore.NtlmApiAuth/src/SAIF.NetCore.NtlmApiAuth/Middleware/OnBehalfOfUserClaimMiddleware.cs
  • src/SAIF.NetCore.NtlmApiAuth/src/SAIF.NetCore.NtlmApiAuth/Services/OnBehalfOfUserClaimService.cs