Skip to main content

Identity & auth overview

Identity is generic over <TUser, TRole> at the platform layer (PlatformDbContext<TUser,TRole>), closed to concrete DomainUser/DomainRole types in a reference configuration's own DbContext (e.g. KandraWmsDbContext).

  • Two JWT auth paths: human users authenticate with a username/password JWT flow; non-human callers (integrations, jobs) use API keys instead.
  • Feature flags ride on the same JWT: LoginService evaluates every enabled Microsoft.FeatureManagement flag and stamps a feature claim per name into the token at login/refresh (optionally filtered by an unregistered-by-default IClientFeatureFilter hook, to keep server-only flags off the client). The client's JwtFeatureDefinitionProvider reads those claims back via IAuthenticationContext. There is no declarative UI-gating attribute yet — Blazor code calls IFeatureManager.IsEnabledAsync(...) directly.
  • ICallerContext carries run-as-user/timezone context through the job scheduler and other non-HTTP-request execution paths.

See the platform architecture doc §13 for the full identity/auth design, and Generated API Reference for the concrete API surface once the XML doc sync has run.