Skip to content

SAIF.NetCore.NtlmApiAuth overview

Documentation context: NuGet package (pipeline-packed), consumed as SAIF.NetCore.NtlmApiAuth by ASP.NET Core server and client applications.

SAIF.NetCore.NtlmApiAuth works around the NTLM/Kerberos "double hop" limitation by letting a calling application forward an end user's name in an OnBehalfOfUser HTTP header, and letting the receiving API authorize both the calling (service-account) identity and the forwarded end-user identity against AD roles through AuthService's SecurityAPI. It targets net8.0 and net10.0.

Purpose

  • Lets a server-side API require that a named role be held by the authenticated caller and, when present, by a header-named "on behalf of" end user, so role checks survive a double-hop scenario where the API cannot directly authenticate the end user.
  • Supplies client-side helpers so an outbound caller can resolve the current user's name and attach or forward the OnBehalfOfUser header to downstream HTTP calls made through IHttpJsonClient.

Responsibilities

  • Convert an inbound OnBehalfOfUser header into a claim on the authenticated identity.
  • Build named ASP.NET Core authorization policies from one RoleRequirement per role and evaluate each requirement via a dual-identity authorization check.
  • Authorize the request user's role and, when an on-behalf-of user is present, that user's role too, by delegating to SAIF.NetCore.AuthService's ISecurityClient.IsAuthorized.
  • Provide ICurrentUserService (MVC and Blazor variants) so client code can resolve the current user's name.
  • Attach or forward the OnBehalfOfUser header on an IHttpJsonClient instance.
  • Optionally expose the header as a Swagger UI parameter when a debugger is attached.

Key components

  • RoleRequirement: self-handling IAuthorizationRequirement/AuthorizationHandler<RoleRequirement> that evaluates one role against both identities.
  • NtlmApiAuthorizationService: the dual-identity decision service; the only type that calls out to AuthService.
  • ConfigureRoleAuthorizationOptions: abstract options base class consumers subclass to declare named policies.
  • OnBehalfOfUserClaimMiddleware / OnBehalfOfUserClaimService: convert the inbound header into a claim.
  • ICurrentUserService (MvcCurrentUserService, BlazorCurrentUserService): resolves the current user's name on the client side.
  • IHttpJsonClientExtensions.ConfigureOnBehalfOfUserAuthorization / HttpContextAccessorExtensions.ForwardOnBehalfOfUserHeader: client-side header helpers.

Sources

  • src/SAIF.NetCore.NtlmApiAuth/src/SAIF.NetCore.NtlmApiAuth/SAIF.NetCore.NtlmApiAuth.csproj
  • src/SAIF.NetCore.NtlmApiAuth/README.md