From 6792c4d62777926800be740f8456b5a3363af07b Mon Sep 17 00:00:00 2001
From: woksin <sindrewilting@gmail.com>
Date: Fri, 2 Oct 2026 01:43:36 +0200
Subject: [PATCH] Align routing fixtures with fail-closed identity verification

---
 .../AuthProxy.Security.Specs/given/ServiceRoutingHarness.cs   | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/Source/AuthProxy.Security.Specs/given/ServiceRoutingHarness.cs b/Source/AuthProxy.Security.Specs/given/ServiceRoutingHarness.cs
index a1342406..0637f500 100644
--- a/Source/AuthProxy.Security.Specs/given/ServiceRoutingHarness.cs
+++ b/Source/AuthProxy.Security.Specs/given/ServiceRoutingHarness.cs
@@ -143,17 +143,20 @@ protected override void Dispose(bool disposing)
     /// <inheritdoc/>
     protected override void ConfigureWebHost(IWebHostBuilder builder)
     {
+        // These origins record routing, not identity verdicts. Keep service claim authorization enabled.
         builder
             .UseEnvironment("Production")
             .ConfigureAppConfiguration((_, config) => config.AddInMemoryCollection(new Dictionary<string, string?>
             {
                 [$"{C.AuthProxy.SectionKey}:Services:reports:PathPrefix"] = ReportsPrefix,
                 [$"{C.AuthProxy.SectionKey}:Services:reports:StripPathPrefix"] = "true",
+                [$"{C.AuthProxy.SectionKey}:Services:reports:ResolveIdentityDetails"] = "false",
                 [$"{C.AuthProxy.SectionKey}:Services:reports:Backend:BaseUrl"] = Reports.BaseUrl,
                 [$"{C.AuthProxy.SectionKey}:Services:reports:Frontend:BaseUrl"] = ReportsFrontend.BaseUrl,
                 [$"{C.AuthProxy.SectionKey}:Services:reports:AnonymousPaths:0"] = $"{ReportsPrefix}/api/health",
 
                 [$"{C.AuthProxy.SectionKey}:Services:admin:Hosts:0"] = AdminHost,
+                [$"{C.AuthProxy.SectionKey}:Services:admin:ResolveIdentityDetails"] = "false",
                 [$"{C.AuthProxy.SectionKey}:Services:admin:Backend:BaseUrl"] = Admin.BaseUrl,
                 [$"{C.AuthProxy.SectionKey}:Services:admin:Frontend:BaseUrl"] = Admin.BaseUrl,
                 [$"{C.AuthProxy.SectionKey}:Services:admin:Authorization:RequiredClaims:0:Claim"] = AdminClaim,
@@ -161,6 +164,7 @@ protected override void ConfigureWebHost(IWebHostBuilder builder)
 
                 [$"{C.AuthProxy.SectionKey}:Services:portal:Hosts:0"] = "portal.example.test",
                 [$"{C.AuthProxy.SectionKey}:Services:portal:Hosts:1"] = "xn--bcher-kva.example.test",
+                [$"{C.AuthProxy.SectionKey}:Services:portal:ResolveIdentityDetails"] = "false",
                 [$"{C.AuthProxy.SectionKey}:Services:portal:Backend:BaseUrl"] = Portal.BaseUrl,
                 [$"{C.AuthProxy.SectionKey}:Services:portal:Frontend:BaseUrl"] = Portal.BaseUrl,