Skip to main content

Authentication and Authorization

Audience​

Developers, QA engineers, support engineers, security engineers, solution architects, and implementation partners.

Reference Content​

This page records source-verified technical behavior and boundaries for the workforce-scheduling capability.

Summary​

Attendance Service registers token authentication for two trusted token sources and registers named policies that require an authenticated principal. Authentication and authorization middleware are present.

Verified enforcement​

The scheduling endpoint groups do not declare an authorization requirement, and no global fallback authorization policy was found. The direct surface also performs no role check. The compatibility surface checks privileged administrative roles for mutations, but its reads rely on tenant-context behavior rather than an explicit authentication requirement.

The monolith implementation differs: its controller requires authentication, and mutations require an administrative role. Frontend route and menu guards provide usability controls only and cannot replace server authorization.

Security assessment​

This is a material enforcement gap. Middleware availability and named policy registration do not protect unannotated endpoints. Missing tenant context can cause tenant-dependent operations to fail, but that is not equivalent to authenticating or authorizing the caller.

Required remediation direction​

Apply an explicit authenticated fallback or group-level requirement, then apply least-privilege policies to reads and mutations. Verify both token sources, compatibility behavior, privileged tenant access, and negative cases with automated tests before cutover.

Source References​

  • microservices/src/attendance-service/Program.cs
  • microservices/src/attendance-service/Api/AttendanceShiftPolicyEndpoints.cs
  • microservices/src/attendance-service/Api/ShiftPolicyCompatEndpoints.cs
  • Controllers/ShiftsController.cs

See Also​

Keywords​

  • Workforce scheduling
  • Shift policy
  • Attendance integration

Revision Information​

  • Status: Draft
  • Last reviewed: 2026-07-20
  • Next review: 2026-10-20