---
title: SAIF.NetCore.NtlmApiAuth overview
summary: High-level purpose, scope, and responsibilities for this library.
status: draft
owner: SAIF Platform Team
last_reviewed: 2026-10-02
library: SAIF.NetCore.NtlmApiAuth
reference_type: package
---

# SAIF.NetCore.NtlmApiAuth overview

> **Documentation context:** NuGet package (pipeline-packed), consumed as `SAIF.NetCore.NtlmApiAuth` by ASP.NET Core server and client applications.

SAIF.NetCore.NtlmApiAuth works around the NTLM/Kerberos "double hop" limitation by letting a calling application forward an end user's name in an `OnBehalfOfUser` HTTP header, and letting the receiving API authorize **both** the calling (service-account) identity and the forwarded end-user identity against AD roles through AuthService's SecurityAPI. It targets `net8.0` and `net10.0`.

## Purpose
- Lets a server-side API require that a named role be held by the authenticated caller and, when present, by a header-named "on behalf of" end user, so role checks survive a double-hop scenario where the API cannot directly authenticate the end user.
- Supplies client-side helpers so an outbound caller can resolve the current user's name and attach or forward the `OnBehalfOfUser` header to downstream HTTP calls made through `IHttpJsonClient`.

## Responsibilities
- Convert an inbound `OnBehalfOfUser` header into a claim on the authenticated identity.
- Build named ASP.NET Core authorization policies from one `RoleRequirement` per role and evaluate each requirement via a dual-identity authorization check.
- Authorize the request user's role and, when an on-behalf-of user is present, that user's role too, by delegating to `SAIF.NetCore.AuthService`'s `ISecurityClient.IsAuthorized`.
- Provide `ICurrentUserService` (MVC and Blazor variants) so client code can resolve the current user's name.
- Attach or forward the `OnBehalfOfUser` header on an `IHttpJsonClient` instance.
- Optionally expose the header as a Swagger UI parameter when a debugger is attached.

## Key components
- `RoleRequirement`: self-handling `IAuthorizationRequirement`/`AuthorizationHandler<RoleRequirement>` that evaluates one role against both identities.
- `NtlmApiAuthorizationService`: the dual-identity decision service; the only type that calls out to AuthService.
- `ConfigureRoleAuthorizationOptions`: abstract options base class consumers subclass to declare named policies.
- `OnBehalfOfUserClaimMiddleware` / `OnBehalfOfUserClaimService`: convert the inbound header into a claim.
- `ICurrentUserService` (`MvcCurrentUserService`, `BlazorCurrentUserService`): resolves the current user's name on the client side.
- `IHttpJsonClientExtensions.ConfigureOnBehalfOfUserAuthorization` / `HttpContextAccessorExtensions.ForwardOnBehalfOfUserHeader`: client-side header helpers.

## Related documentation
- [Index](index.md)
- [Architecture](architecture.md)
- [Dependencies](dependencies.md)
- [Operations and processes](operations-processes.md)
- [Business rules](business-rules.md)
- [Security and authorization](security-authorization.md)
- [Service registration](service-registration.md)
- [API reference](api/index.md)

## Sources
- `src/SAIF.NetCore.NtlmApiAuth/src/SAIF.NetCore.NtlmApiAuth/SAIF.NetCore.NtlmApiAuth.csproj`
- `src/SAIF.NetCore.NtlmApiAuth/README.md`