Skip to main content

LMS Authentication and Request Context

Summary​

Source-backed Draft reference for LMS Authentication and Request Context across the implemented Training Service and, where applicable, Gateway surface.

Audience​

API consumers, engineering, QA, support, architecture, security, product, and implementation reviewers.

Reference Content​

Confirmed behavior​

ControlTraining Service evidence
Authentication registrationNot found
Authorization registrationNot found
Authentication middlewareNot executed
Authorization middlewareNot executed
Bearer-token processingNot configured locally
Endpoint policiesNo authorization declarations found
Resource ownershipNo employee/self or role ownership checks found
CorrelationShared correlation middleware is executed
Tenant/actor contextHTTP context adapter is registered

Tenant context can read identity and request metadata, but this is not proof of authentication. Read and write delegates do not declare authorization. UI visibility checks, where present, do not secure these APIs.

Gateway forwards request context downstream through its shared send path, but Training Service does not establish or validate Gateway trust in the inspected code.

Missing context​

Writes calling the required-tenant accessor fail when tenant context cannot be resolved; middleware maps that failure to bad request. Actor email/user context may be absent and audit helpers accept the resulting absence. Some state-changing operations use an entity's tenant and therefore do not call the required-tenant accessor.

Classification​

Service-local authentication and authorization are Foundation. Endpoint and resource authorization are Not implemented in the inspected Training mapping.

Source References​

  • microservices/src/training-service/Program.cs
  • microservices/src/training-service/Application/Common.cs
  • microservices/src/training-service/Api/TrainingEndpoints.cs
  • microservices/src/gateway-api/EssEndpoints.cs

See Also​

Keywords​

  • LMS API
  • Training Service
  • Source-backed contract

Revision Information​

  • Status: Draft
  • Last reviewed: 2026-07-17
  • Review cycle: Quarterly