SAIF.NetCore.NtlmApiAuth exposes two IServiceCollection extension methods (one server-side, one client-side), one IApplicationBuilder middleware extension, and one SwaggerGenOptions extension. AddNtlmApiAuthorization<T>() registers five server-side services of its own (3 Scoped, 2 Transient) plus the framework's AddAuthorization(); AddNtmlApiAuthorizationClientServices() separately registers one additional client-side ICurrentUserService (Scoped), selecting either MvcCurrentUserService or BlazorCurrentUserService depending on ClientAppType — not a second, simultaneous registration on top of the server-side five. Calling both extensions on the same IServiceCollection (an unusual but possible combination) registers ICurrentUserService twice, with the client-side call's implementation winning, rather than producing an unqualified total of seven distinct services. The library requires the consuming application to register ISecurityClient, IEnvironmentClient, IHttpJsonClient, IHttpContextAccessor, and host authentication itself.
All registrations use Add*, not TryAdd*: calling both AddNtlmApiAuthorization<T>() and AddNtmlApiAuthorizationClientServices(this IServiceCollection services, ClientAppType appType = ClientAppType.Mvc) registers ICurrentUserService twice — the last call wins. RoleRequirement is not registered as IAuthorizationHandler; it relies on the framework PassThroughAuthorizationHandler because it is a self-handling requirement.
ConfigureRoleAuthorizationOptions is an abstract IConfigureOptions<AuthorizationOptions> base class; consumers must implement SetPolicies. There is no library-defined options POCO and no IConfiguration binding.
OnBehalfOfUserClaimMiddleware (IMiddleware, Scoped) via UseNtlmApiAuthorization()
Always
Must run after the request identity is authenticated (IIS Windows auth sets it before the pipeline; otherwise must follow UseAuthentication()), and before UseAuthorization()/endpoint execution.
Note: Statements marked with * were inferred from code structure, naming
conventions, or contextual evidence where direct confirmation was not available
in source artifacts.