AppSurface Auth ASP.NET Core Bridge Example

This example proves ForgeTrust.AppSurface.Auth.AspNetCore can consume a normal ASP.NET Core authentication and authorization setup without owning it.

For new local package-consumer fake auth, prefer the DevAuth example. This bridge example keeps the header-driven X-Proof-User handler only as a low-level adapter proof for hosts that already own their authentication scheme.

The host still configures:

• AddAuthentication(...)
• AddAuthorization(...)
• UseAuthentication()
• UseAuthorization()
• the named OperatorsOnly policy

The AppSurface adapter adds only:

• AddAppSurfaceAspNetCoreAuth(...)
• IAppSurfaceAspNetCorePolicyEvaluator
• AppSurface auth context/result mapping

Run it:

dotnet run --project examples/auth-aspnetcore-bridge --urls http://127.0.0.1:5057

From another terminal:

curl -s -H 'X-Proof-User: operator' http://127.0.0.1:5057/allowed
curl -s -H 'X-Proof-User: viewer' http://127.0.0.1:5057/forbidden
curl -s http://127.0.0.1:5057/unauthenticated
curl -s -H 'X-Proof-User: operator' http://127.0.0.1:5057/missing-policy
curl -s -H 'X-Proof-User: nosub' http://127.0.0.1:5057/missing-subject
curl -s http://127.0.0.1:5057/missing-services

Expected outcomes:

The fake X-Proof-User authentication scheme is only for this local adapter proof. Do not copy it into product apps. Use ForgeTrust.AppSurface.Auth.AspNetCore.DevAuth for selectable local personas, and use real ASP.NET Core authentication handlers and policies for deployed hosts.