Skip to main content

Authentication

Audience​

Developers, QA engineers, support engineers, security engineers, solution architects, and implementation partners.

Reference Content​

This page records source-verified Workforce Scheduling API behavior and boundaries.

Summary​

Attendance Service registers token authentication capable of validating tokens from two trusted issuing contexts. Issuer, audience, signing-key, lifetime, email-name, and role-claim validation are configured when corresponding runtime values exist. Authentication middleware executes before endpoint handling.

Enforcement finding​

No scheduling route group calls an authorization requirement, and no global fallback authorization policy was verified. Consequently, authentication is registered but not explicitly mandatory for the 23 scheduling endpoints. The operational endpoints are also not explicitly protected.

Compatibility mutation logic treats an unauthenticated request as a trusted gateway or service-to-service request and does not reject it. This is verified code behavior, not a recommended trust model.

OpenAPI​

Endpoint discovery and Swagger generation are registered, but no OpenAPI security scheme or endpoint security annotations were verified in the reviewed configuration.

Classification​

Authentication registration is Implemented. Scheduling endpoint authentication enforcement is Not implemented at the route/fallback layer. Production edge enforcement requires confirmation.

Source References​

  • microservices/src/attendance-service/Program.cs
  • microservices/src/attendance-service/Api/AttendanceShiftPolicyEndpoints.cs
  • microservices/src/attendance-service/Api/ShiftPolicyCompatEndpoints.cs

See Also​

Keywords​

  • Workforce Scheduling API
  • Shift endpoints
  • Attendance policy API

Revision Information​

  • Status: Draft
  • Last reviewed: 2026-07-20
  • Next review: 2026-10-20