Skip to main content

Authentication, Authorization, and Tenant Context

Summary​

The extracted Recruitment host registers token authentication and resolves tenant/user context from trusted identity and request context. However, its inspected endpoint policy collection is empty and the endpoint mappings do not require authorization. The gateway or deployment perimeter may add controls, but those controls were not proven at the service endpoint boundary.

Audience​

Backend developers, QA, support, security reviewers, and solution architects.

Security context flow​

Extracted Recruitment boundary​

Tenant context resolves a numeric tenant, current user/email, and elevated identity indicators from claims or forwarded request context. Missing tenant context is rejected by application mapping. Development aliases exist in source and are intentionally not reproduced here; they must not be treated as production identity controls.

Registration of authentication middleware is not the same as endpoint authorization. The inspected native and compatibility endpoint groups do not apply required authorization policies. Security assessment must include direct-service reachability and gateway enforcement.

Monolith HR Operations boundary​

The HR Operations controller is authorization-protected and performs additional permission/service, tenant, administrator, and direct-report checks depending on the operation. These checks are controller-centric and separate from Recruitment policies.

The monolith Recruitment compatibility controller has mixed action-level authorization behavior rather than one class-wide rule. Gateway path selection can therefore change both implementation and effective security boundary.

Tenant persistence boundary​

Global query filters provide a default tenant scope, but they are not a substitute for authorization. The active-onboarding lookup that bypasses global filters requires explicit review, as described in Repositories and persistence.

Requires confirmation​

  • Whether all Recruitment service deployments are unreachable except through an authenticated gateway.
  • The authoritative contract for trusted forwarded tenant and user context.
  • Required endpoint policies for native, public-token, and compatibility operations.
  • Security tests covering tenant isolation and runtime route selection.

Source References​

  • microservices/src/recruitment-service/Program.cs
  • microservices/src/recruitment-service/Api/Policies.cs
  • microservices/src/recruitment-service/Infrastructure/Persistence.cs
  • microservices/src/recruitment-service/Api/RecruitmentEndpoints.cs
  • microservices/src/recruitment-service/Api/RecruitmentCompatEndpoints.cs
  • Controllers/HrOperationsController.cs
  • Controllers/RecruitmentController.cs

See Also​

Keywords​

  • Endpoint authorization
  • Tenant isolation
  • Forwarded identity context

Revision Information​

  • Status: Draft
  • Last reviewed: 2026-07-20
  • Review cycle: Quarterly