Skip to content

SAIF.NetCore.LegacyAuth overview

Documentation context: Packaged Component (NuGet)

SAIF.NetCore.LegacyAuth is a small implementation-layer package that lets an ASP.NET Core application issue the legacy SAIFAUTH credential cookie — the user's name and password, DPAPI-encrypted with the Windows machine key and the client's remote IP address as entropy — so that a legacy .NET Framework component referred to in source as "SecurityModule" can authenticate the user on the same host.

Purpose

  • Build a tab-delimited user/password payload and encrypt it with the Windows Data Protection API (DPAPI), scoped to the local machine key and bound to the client's remote IP address as entropy, then write it as the SAIFAUTH response cookie for a legacy .NET Framework reader to decrypt.
  • Provide a matching ClearCookie operation to remove the SAIFAUTH cookie, and a reusable DPAPI P/Invoke wrapper over the native crypt32.dll encrypt surface that consumers can use independently of the cookie service.
  • Act purely as a credential-transport bridge between a modern login flow (inferred to be OIDC-based*, per an excluded source comment referencing "OnlineLogin") and legacy Framework sites — it never reads or validates a request cookie, so it has no authentication or authorization enforcement role of its own.
  • There is no consumer of this package anywhere in this repository; its only known in-repo relationship is the shared SAIFAUTH cookie-name convention with LegacyBolAuthMiddleware in SAIF.NetCore.ServiceExtensions, which checks presence only and does not reference this package or decrypt the value.

Responsibilities

  • Encrypt and issue the SAIFAUTH legacy authentication cookie on behalf of a consuming application.
  • Clear the SAIFAUTH cookie on logout or equivalent consumer-initiated action.
  • Expose a general-purpose DPAPI encrypt wrapper and its supporting Win32 interop types for direct consumer use.

Key components

  • ILegacyAuthCookieService / LegacyAuthCookieService: builds the credential payload, encrypts it with DPAPI, and writes or deletes the Set-Cookie: SAIFAUTH header.
  • DPAPI: a self-contained P/Invoke wrapper over CryptProtectData/CryptUnprotectData, with UTF-8 + Base64 string helpers; the public surface includes both raw native encrypt/decrypt externs, while only the managed Decrypt string/byte helper overloads are internal and unused by any consumer in this repository.
  • KeyType, DATA_BLOB, CRYPTPROTECT_PROMPTSTRUCT: the supporting enum and Win32 interop structs used internally by DPAPI.

Note: Statements marked with * were inferred from code structure, naming conventions, or contextual evidence where direct confirmation was not available in source artifacts.

Sources

  • src/SAIF.NetCore.LegacyAuth/src/SAIF.NetCore.LegacyAuth/SAIF.NetCore.LegacyAuth/SAIF.NetCore.LegacyAuth.csproj
  • src/SAIF.NetCore.LegacyAuth/src/SAIF.NetCore.LegacyAuth/SAIF.NetCore.LegacyAuth/ILegacyAuthCookieService.cs
  • src/SAIF.NetCore.LegacyAuth/src/SAIF.NetCore.LegacyAuth/SAIF.NetCore.LegacyAuth/LegacyAuthCookieService.cs
  • src/SAIF.NetCore.LegacyAuth/src/SAIF.NetCore.LegacyAuth/SAIF.NetCore.LegacyAuth/DPAPI.cs