Skip to content

ADService

ADService is an internal class that performs recursive Active Directory group-membership lookups using System.DirectoryServices.AccountManagement and System.DirectoryServices.DirectorySearcher. It is the sole AD-access layer used by MachineSecurityService.

Purpose

  • Resolve the distinct set of user (and, when recursing, nested group) members of an AD group via LDAP, for consumption by MachineSecurityService.IsAuthorized.

Context

  • Namespace: SAIF.Framework.Security.Utilities
  • Assembly/package: SAIF.Framework.Security.EnvironmentApi
  • Visibility: internal — not part of this library's public API surface; documented here because it is the concrete AD-access implementation underlying the public MachineSecurityService*.

Public members

Member Signature Purpose
GetUsersByGroup public string[] GetUsersByGroup(string groupName, string ldap = "LDAP://slmdc01.corp.saif.com:389/DC=corp,DC=saif,DC=com", string domain = "saif", bool recurse = true) Resolves the group via PrincipalContext/GroupPrincipal.FindByIdentity, then recursively enumerates group and user membership via DirectorySearcher, returning distinct, sorted sAMAccountName values.

Internal (non-public) helper methods GetMembership and GetMembershipRecursively implement the LDAP-filter traversal and cycle-avoidance logic and are not part of the type's externally visible surface.

Behavioral notes

  • Uses the LDAP filters (&(objectClass=group)(memberOf=<groupDn>)) and (&(objectClass=user)(memberOf=<groupDn>)) to walk nested group and user membership respectively.
  • Tracks already-searched group and user SAMAccountNames (uppercased) to avoid infinite loops on circular group nesting.
  • Returns null (not an empty array) if the target group cannot be found via GroupPrincipal.FindByIdentity*.
  • The default ldap/domain parameter values match the hard-coded constants also used by SecurityServiceClient (LDAP, DOMAIN), though MachineSecurityService always supplies its own runtime-resolved values rather than relying on these defaults*.

Constraints and usage notes

  • This class is internal to the assembly; it cannot be instantiated or referenced directly by downstream consumers of this library — only MachineSecurityService uses it.
  • Uses the System.DirectoryServices/System.DirectoryServices.AccountManagement APIs and therefore requires a functioning connection to the target Active Directory domain at runtime.

Note: Statements marked with * were inferred from code structure, naming conventions, or contextual evidence where direct confirmation was not available in source artifacts. Statements marked with ** could not be confirmed; treat as unknown until verified.

Sources

  • SAIF.Framework.Security.EnvironmentApi\Core\Services\ADService.cs
  • SAIF.Framework.Security.EnvironmentApi\Core\Services\MachineSecurityService.cs