Skip to main content

Troubleshooting Authentication and Authorization

Summary​

This page explains how to interpret authentication and authorization symptoms in HR Suit Asset Management. The key fact that shapes every diagnosis here is that the asset native and compatibility endpoints are anonymous and tenant-scoped by design, because the service runs inside a private mesh. There is no backend role gate on the asset endpoints. The portal only hides navigation; it does not enforce backend authorization. As a result, most "unexpected access" reports are not defects in the asset service but a consequence of the intended private-mesh posture, and authorization-policy questions belong to security and identity.

Audience​

Support engineers, security engineers, developers, and solution architects investigating sign-in failures, token rejections at the edge, or reports that a user reached asset data they were not expected to reach.

Symptoms​

  • A user reports they reached asset screens or data they did not expect to be able to reach.
  • A request fails at the gateway or portal with a token or sign-in error, while direct mesh calls behave differently.
  • A token appears expired or invalid and edge access is denied.
  • Confusion about why the asset endpoints do not reject based on role.

Cause​

Scope​

This page covers the gateway and portal authentication edge and the asset endpoints' own authorization posture. It does not cover identity provider configuration or role policy design.

Likely causes​

  • The asset endpoints are anonymous by design, so any access that reaches them is not filtered by role. Apparent over-access reflects the absence of a backend role gate, not a broken gate.
  • The frontend hides navigation for roles that should not see a feature, which can make it look as though a backend gate exists when it does not.
  • A missing or invalid JWT affects the gateway and portal, where JWT Bearer validation runs with multi-key support (monolith and Identity keys), Email as the name claim, Role as the role claim, and lifetime validation enabled. It does not affect the asset endpoints' own gate, because they have none.

Resolution​

Safe diagnostics​

  • Confirm whether the request went through the portal or gateway edge versus a direct mesh call. Edge token errors are an edge concern.
  • Confirm the reported access is actually asset-endpoint access rather than a portal navigation state.
  • Treat any request that reaches the asset endpoints as tenant-scoped, not role-scoped, and validate the tenant context instead of expecting a role denial.
  • For questions about whether a role should have been blocked, escalate to security and identity rather than treating it as an asset-service defect.

Validation​

  • Confirm that the observed behavior matches the documented posture: asset endpoints are anonymous and tenant-scoped, edge validates tokens.
  • Confirm the tenant context on the request is correct, using the tenant-context procedures.
  • Confirm no assumption of a backend role gate remains in the ticket.

Evidence to Collect​

  • Whether the request traversed the portal or gateway edge or was a direct mesh call.
  • The response status observed at the edge for token failures.
  • The correlation identifier and timestamp.
  • The role the user held and the screen or endpoint reached.

Escalation​

Route authorization-policy and role-gate questions to security and identity. Route edge token validation issues to the gateway owner. Route portal navigation visibility questions to the frontend team.

Source References​

  • microservices/src/gateway-api/Program.cs
  • microservices/src/asset-service/Api/AssetEndpoints.cs
  • microservices/src/asset-service/Api/AssetCompatEndpoints.cs

See Also​

Keywords​

authentication, authorization, jwt, anonymous endpoints, private mesh

Revision Information​

  • Status: Draft
  • Last reviewed: 2026-07-17
  • Review cycle: Quarterly