---
title: SAIF.NetCore.OIDC dependencies
summary: Internal and external dependencies for this library.
status: draft
owner: SAIF Framework Platform Team
last_reviewed: 2026-10-02
library: SAIF.NetCore.OIDC
reference_type: package
---

# SAIF.NetCore.OIDC dependencies

This library takes a single internal NuGet dependency, on the foundation-layer `SAIF.NetCore.ServiceContracts` package, one direct external dependency on `Okta.AspNetCore` for OIDC token validation, and it makes its own outbound calls to Okta for the authorization-code flow and token refresh rather than delegating those calls to another SAIF library.

## Internal dependencies

| Dependency | Reference Type | Usage |
| --- | --- | --- |
| [SAIF.NetCore.ServiceContracts](../saif-netcore-servicecontracts/overview.md) | NuGet Package (same-repo) | Supplies every service interface this library implements (`IOidcSettings`, `IJwtRefreshService`, `IRoleClaimService`, `IClaimTransformCacheService`, `ILoginRedirectService`, `IJwtAuthorizationCookieClaimService`, `IUrlCaseService`, `IDataProtectionCertService`), shared DTOs/enums (`OidcAppCredentials`, `JwtSet`, `SystemType`, `CharacterCasing`), and the `IEnvironmentClient`, `IHttpJsonClient`, `ISaifLogService`, `ISystemHashService` interfaces this library consumes at runtime. |

## External dependencies

| Dependency | Version | Usage |
| --- | --- | --- |
| Okta.AspNetCore | 3.5.0 | Supplies `StrictSecurityTokenValidator` and `OktaHttpMessageHandler`, used by `ConfigureOpenIdConnectOptions` to harden ID-token validation and tag the backchannel HTTP handler for Okta requests. |
| Microsoft.AspNetCore | 2.2.0 | Legacy ASP.NET Core meta-package reference; the shared framework actually supplies the authentication/cookie/OpenIdConnect types used at runtime*. |
| Microsoft.Extensions.Options | 3.1.18 | Supplies `IConfigureNamedOptions<T>`, implemented by `ConfigureCookieAuthenticationOptions` and `ConfigureOpenIdConnectOptions`. |

## API dependencies

| Endpoint | Method | Called from | Source library | Reached via | Usage |
| --- | --- | --- | --- | --- | --- |
| `{OktaBaseUrl}{OktaAuthorizationServerUrl}` discovery/authorize/token/userinfo endpoints (for example `/oauth2/default/.well-known/openid-configuration`) | GET / POST | `ConfigureOpenIdConnectOptions.Configure` | This library | — | Executes the OIDC authorization-code flow (metadata discovery, authorize redirect, token exchange, userinfo) through the ASP.NET Core `OpenIdConnectHandler` configured by this library*. |
| `{OktaBaseUrl}{OktaAuthorizationServerUrl}{RefresnTokenUrl}{RefreshTokenQueryString}{refreshToken}` (for example `/oauth2/default/v1/token`) | POST | `JwtRefreshService.Refresh` | This library | — | Refreshes an expired access/ID token pair by posting the refresh grant, as a query string, to Okta's token endpoint via the injected `IHttpJsonClient` (implemented by `SAIF.NetCore.HttpClients`). |

## Dependency risks and notes
- The refresh-token POST sends the OAuth refresh grant in the request **query string**, and `refreshToken` is not URL-encoded, so the token can be exposed in HTTP client or Okta request logs (`JwtRefreshService.Refresh`)*.
- The returned `refresh_token` from a successful refresh call is discarded (`JwtRefreshService.Refresh` builds `JwtSet` from only `AccessToken`/`IdToken`), so there is no refresh-token rotation handling.
- `Newtonsoft.Json` and `System.IdentityModel.Tokens.Jwt` are used (`RefreshTokenResult`, `RefreshJwtMiddleware`, `ConfigureOpenIdConnectOptions`) but are not declared as direct `PackageReference`s; the library relies on these arriving transitively through `Okta.AspNetCore` or `SAIF.NetCore.ServiceContracts`*.
- `Microsoft.AspNetCore` 2.2.0 and `Microsoft.Extensions.Options` 3.1.18 are out-of-support versions pinned on a `net8.0`/`net10.0` library.
- The role-transform cache (`ClaimTransformationCacheService`) is a singleton backed by a non-thread-safe `Dictionary`, so concurrent requests for different subjects can corrupt it.
- The lookup-key typo `RoleClaimIdentitifier` is defined in this library's own `Constants.cs` (`RoleClaimIdentitifierKey = "RoleClaimIdentitifier"`), not in `SAIF.NetCore.ServiceContracts`; the `IOidcSettings.RoleClaimIdentifier` property in `ServiceContracts` is correctly spelled. It is used as-is and the matching test mocks the same typo, masking the defect. Separately, and unrelated to this typo, `IOidcSettings` in `ServiceContracts` itself has a distinct property-name typo, `RefresnTokenUrl` (missing an "h"), which this library's `OidcSettings.RefresnTokenUrl` implements as declared.
- `Okta.AspNetCore` is a hard external dependency with no feed-confirmed record (`feedStatus: not-found`), so its provenance and supply-chain status are not tracked by the internal package feed the way same-repo packages are.

## Related documentation
- [Index](index.md)
- [Overview](overview.md)
- [Architecture](architecture.md)
- [Configuration](configuration.md)
- [Operations and processes](operations-processes.md)
- [Business rules](business-rules.md)
- [Security and authorization](security-authorization.md)
- [Service registration](service-registration.md)
- [API reference](api/index.md)

> **Note:** Statements marked with * were inferred from code structure, naming conventions, or
> contextual evidence where direct confirmation was not available in source artifacts. Statements
> marked with ** could not be confirmed; treat as unknown until verified.

## Sources
- `src/SAIF.NetCore.OIDC/src/SAIF.NetCore.OIDC/Options/ConfigureOpenIdConnectOptions.cs`
- `src/SAIF.NetCore.OIDC/src/SAIF.NetCore.OIDC/Options/ConfigureCookieAuthenticationOptions.cs`
- `src/SAIF.NetCore.OIDC/src/SAIF.NetCore.OIDC/Services/JwtRefreshService.cs`
- `src/SAIF.NetCore.OIDC/src/SAIF.NetCore.OIDC/Services/ClaimTransformationCacheService.cs`
- `src/SAIF.NetCore.OIDC/src/SAIF.NetCore.OIDC/Contracts/RefreshTokenResult.cs`
- `src/SAIF.NetCore.OIDC/src/SAIF.NetCore.OIDC/Middleware/RefreshJwtMiddleware.cs`
- `src/SAIF.NetCore.OIDC/src/SAIF.NetCore.OIDC/Constants.cs`
- `src/SAIF.NetCore.OIDC/src/SAIF.NetCore.OIDC/SAIF.NetCore.OIDC.csproj`
- `src/SAIF.NetCore.OIDC/Directory.Packages.props` (central package management; declaring source for the `Okta.AspNetCore`/`Microsoft.AspNetCore`/`Microsoft.Extensions.Options` version numbers cited on this page)
- `src/SAIF.NetCore.ServiceContracts/SAIF.NetCore.ServiceContracts/SAIF.NetCore.ServiceContracts/IOidcSettings.cs` (consumer dependency; source of the distinct `RefresnTokenUrl` interface-level typo)