Skip to main content

Helpdesk API Authentication

Audience​

Developers, security, QA, support and architects.

Summary​

The Helpdesk Service can read claims and forwarded request headers, but its reviewed startup does not register or invoke authentication middleware.

Reference Content​

HttpTenantContext reads tenant, user and email values from the current principal or forwarded context and recognizes a super-administrator role. These values support attribution and tenant filtering; their presence does not prove authentication.

The reviewed gateway likewise forwards context to employee downstream calls, but the Helpdesk-specific source does not establish a trusted authenticated identity boundary. The endpoint catalog therefore records no explicit authentication requirement.

Requires confirmation​

Production ingress authentication, accepted identity scheme, trusted proxy boundary, forwarded-header integrity and service-to-service authentication require confirmation.

Source References​

  • microservices/src/helpdesk-service/Program.cs
  • microservices/src/helpdesk-service/Application/Common.cs
  • microservices/src/gateway-api/Program.cs

See Also​

Keywords​

API authentication, claims, forwarded identity, authentication gap.

Revision Information​

  • Status: Draft
  • Last reviewed: 2026-07-20
  • Next review: 2026-10-20