Skip to content

Register Edge API auth services

This operation registers JWT-bearer authentication for external-facing/Edge APIs, which never accept Windows/Negotiate authentication. It is used by Core and Edge API startup for EdgeAPIStartup.

Field Value
Operation ID OP-04
Trigger EdgeAPIStartup.ConfigureServices (or an application) calls RegisterEdgeAPIAuthServices().
Inputs None (parameterless).
Outputs JWT bearer authentication is registered and made the default scheme.
Primary components IServiceCollectionExtensions.RegisterEdgeAPIAuthServices
Entry point src/SAIF.NetCore.ServiceExtensions/SAIF.NetCore.ServiceExtensions/SAIF.NetCore.ServiceExtensions/IServiceCollectionExtensions.cs (L99–110)

Steps

  1. ConfigureOptions<ConfigureJwtBearerOptions>() (BR-SE-06)

Origin: This registers an IConfigureOptions<JwtBearerOptions> implemented by Configure JWT bearer options (SAIF.NetCore.AuthService); the configurator itself does not run now — it runs later, the first time the framework resolves JwtBearerOptions for a request. 2. AddTokenIdentityService() registers Singleton ISecurityClient → SecurityClient, Scoped IIdentityService → TokenIdentityService, Transient IIdentityServiceAccessor → IdentityServiceAccessor.

Origin: These types' identity-resolution logic is implemented in Resolve the current identity service (SAIF.NetCore.AuthService); this step only registers them in the container — resolution runs later, per request, when a consumer injects IIdentityServiceAccessor. 3. AddAuthentication(JwtBearerDefaults.AuthenticationScheme).AddJwtBearer() (BR-SE-06)

Origin: This registers the JwtBearer authentication handler (Microsoft.AspNetCore.Authentication.JwtBearer), the same handler configured by Register authentication services (SAIF.NetCore.AuthService); token validation itself runs later, per incoming request, not during this registration call.

Process flow

This diagram shows the one-time DI registration work performed when RegisterEdgeAPIAuthServices() is called during service configuration, not the per-request JWT validation that runs afterward.

flowchart TD
    Start([RegisterEdgeAPIAuthServices called]) --> S1[Configure JWT bearer options]
    S1 --> S2[Register token identity service]
    S2 --> S3[Add JwtBearer as default scheme]
    S3 --> EndOk([Edge API JWT-only authentication ready])

Failure and edge-case behavior

  • No branching logic; registration always completes once called. Invalid JWT tokens at request time are rejected by the ASP.NET Core authentication middleware per ConfigureJwtBearerOptions.

Sources

  • src/SAIF.NetCore.ServiceExtensions/SAIF.NetCore.ServiceExtensions/SAIF.NetCore.ServiceExtensions/IServiceCollectionExtensions.cs