Credential Authority

Select which credential branch is trusted without conflating that choice with ASP.NET Core runtime environment.

Two separate axes

Credential authority and application environment are intentionally separate. Credential authority decides which credential material is used. Application environment decides host policy, diagnostics, HSTS, EF logging, and similar runtime behavior.

CredentialAuthority.Local

Local selects local credential material. This normally means app-registration credentials, local developer credentials, or operator workstation credentials. It does not mean the application is running in the Development environment.

CredentialAuthority.Remote

Remote selects deployed-host credential material, such as managed identity. It does not automatically mean the application environment is Production.

Do not infer authority from environment

csharp


// Prefer explicit authority from trusted bootstrap metadata.
var credentialAuthority = bootstrap.CredentialAuthority;

// Avoid this pattern in new code.
var credentialAuthority = builder.Environment.IsProduction()
    ? CredentialAuthority.Remote
    : CredentialAuthority.Local;

Why it matters

Separating the axes allows development hosts to use remote authority for break-glass operations and allows deployed hosts to keep runtime policy independent from credential projection. The result is easier to audit because credential selection is visible in configuration metadata rather than hidden inside environment-name conventions.