---
title: MachineSecurityService
summary: API reference for MachineSecurityService.
status: draft
owner: <owner>
last_reviewed: 2026-07-23
library: SAIF.Framework.Security.EnvironmentApi
reference_type: package
---

# MachineSecurityService

`MachineSecurityService` is the reusable, generic AD group-membership authorization primitive for machine and service accounts. It is the public implementation of the internal `IMachineSecurityService` contract and delegates AD lookups to `ADService`.

## Purpose
- Authorize a machine or service account against an AD group, optionally applying the SAIF `<Name>Resource`/`<Name>TestResource` naming convention. See [security-authorization.md](../../security-authorization.md) for the full authorization architecture.

## Context
- Namespace: `SAIF.Framework.Security.Utilities`
- Assembly/package: `SAIF.Framework.Security.EnvironmentApi`

## Public members
| Member | Signature | Purpose |
| --- | --- | --- |
| MachineSecurityService(ldap, domain) | `public MachineSecurityService(string ldap, string domain)` | Constructs the service bound to a specific LDAP path and domain. |
| IsAuthorized | `public bool IsAuthorized(string machine, ref string groupName, bool isResource = true, bool isProductionResource = true, bool recurse = true)` | Authorizes `machine` against `groupName` (transforming the name to the resource convention when `isResource` is true), returning `false` on any AD-lookup failure. See [BR-006](../../business-rules.md#br-006-machineservice-account-authorization-via-ad-group-membership) and [BR-007](../../business-rules.md#br-007-production-vs-non-production-ad-resource-name-convention). |
| Dispose | `public void Dispose()` | No-op; retained to fulfill the `IDisposable` contract inherited via `IMachineSecurityService`. |

## Behavioral notes
- `IsAuthorized` optionally appends `Test` (when `isProductionResource` is false) then `Resource` to `groupName` before the AD lookup, per the SAIF resource-name convention.
- Delegates to the private `ADService` property (lazily instantiated) to call `GetUsersByGroup`, then compares each returned member's SAMAccountName to `machine`, trimming `$` suffixes from both sides and comparing case-insensitively.
- Fails closed: any exception during the AD lookup is caught, logged via `Debug.WriteLine`, and the method returns `false` rather than propagating the error or throwing*.
- The class no longer holds unmanaged resources requiring disposal; `Dispose()` is retained only to satisfy the `IDisposable` contract*.

## Constraints and usage notes
- `IMachineSecurityService` (the interface this class implements) is declared `internal`, so the concrete `MachineSecurityService` class is the practical public entry point for downstream consumers*.
- Callers pass `groupName` by reference; on return it may reflect the resource-name-convention transformation applied internally.
- Used internally by `EnvironmentServiceBase.IsDeveloperMachine` via the private `MachineSecurity` property, with LDAP/domain values resolved at runtime from Environment API global config settings (`ad.ldap.host`, `ad.ldap.internal.root`, `ad.internal.domain`).

> **Note:** Statements marked with * were inferred from code structure, naming conventions, or
> contextual evidence where direct confirmation was not available in source artifacts. Statements
> marked with ** could not be confirmed; treat as unknown until verified.

## Sources
- SAIF.Framework.Security.EnvironmentApi\Core\Services\MachineSecurityService.cs
- SAIF.Framework.Security.EnvironmentApi\Core\Services\IMachineSecurityService.cs
- SAIF.Framework.Security.EnvironmentApi\Services.Common\EnvironmentServiceBase.cs