Cirreum.AuthenticationProvider 2.0.1

Cirreum.AuthenticationProvider

Authentication track abstractions for the Cirreum framework — the contracts scheme implementations and runtime composition build on.

Overview

Cirreum.AuthenticationProvider is the abstraction layer for Cirreum's Authentication track — one of the three that separate concerns across identity: Identity, Authentication, and Authorization. It defines the contracts that:

• Scheme packages implement — Cirreum.Authentication.ApiKey, Cirreum.Authentication.SignedRequest, Cirreum.Authentication.SessionTicket, etc.
• Runtime composition wires — Cirreum.Runtime.AuthenticationProvider (the dynamic forward scheme resolver, auth-event hosted handlers, cache invalidators, boot-time analyzers)
• The umbrella package exposes — Cirreum.Runtime.Authentication (the AddAuthentication(...) app-facing builder)

Contract surface

Schemes:

• ISchemeSelector + SchemeCategory enum — per-request scheme dispatch (open/closed)
• CredentialTransport enum — where the scheme reads its credential
• ISignedRequestAlgorithm + resolver — version-pluggable crypto for SignedRequest scheme
• SessionTicket family — HTTP→long-lived-connection handoff primitives

Patterns:

• IAuthenticationBuilder — the builder surface scheme registrations extend
• [AllowPendingAuth] — opt-in for Two-Phase Auth's anonymous-pending-auth pattern

Compositions:

• AudienceSchemeRegistration — the audience → scheme routing contribution audience-based registrars add per instance
• IRevokedCredentialProvider — app-side credential revocation hydration

Profile enrichment (IUserProfileEnrichmentBuilder, IGraphEnabledBuilder, IExternalGraphEnabledBuilder, ClaimsUserProfileEnricher) is not part of this package — it's host-agnostic (any host may enrich a profile post-authentication, regardless of which — or whether any — auth scheme is active) and lives in Cirreum.Contracts/Cirreum.Domain instead. The same reasoning applies to authentication-boundary resolution (IAuthenticationBoundaryResolver, AuthenticationBoundary): the server user-state pipeline consumes it whether or not any authentication scheme is composed, so it lives in Cirreum.Kernel.

Where it fits

Cirreum.Kernel                  (auth event bus — IAuthenticationEventPublisher/Handler)
Cirreum.AuthenticationProvider  ← this package
Cirreum.Authentication.{Scheme} — ApiKey, SignedRequest, SessionTicket, ...
Cirreum.Runtime.AuthenticationProvider
Cirreum.Runtime.Authentication  (app-facing umbrella; AddAuthentication(...))

License

MIT — see LICENSE.