Skip to content

MachineSecurityService

MachineSecurityService is the reusable, generic AD group-membership authorization primitive for machine and service accounts. It is the public implementation of the internal IMachineSecurityService contract and delegates AD lookups to ADService.

Purpose

  • Authorize a machine or service account against an AD group, optionally applying the SAIF <Name>Resource/<Name>TestResource naming convention. See security-authorization.md for the full authorization architecture.

Context

  • Namespace: SAIF.Framework.Security.Utilities
  • Assembly/package: SAIF.Framework.Security.EnvironmentApi

Public members

Member Signature Purpose
MachineSecurityService(ldap, domain) public MachineSecurityService(string ldap, string domain) Constructs the service bound to a specific LDAP path and domain.
IsAuthorized public bool IsAuthorized(string machine, ref string groupName, bool isResource = true, bool isProductionResource = true, bool recurse = true) Authorizes machine against groupName (transforming the name to the resource convention when isResource is true), returning false on any AD-lookup failure. See BR-006 and BR-007.
Dispose public void Dispose() No-op; retained to fulfill the IDisposable contract inherited via IMachineSecurityService.

Behavioral notes

  • IsAuthorized optionally appends Test (when isProductionResource is false) then Resource to groupName before the AD lookup, per the SAIF resource-name convention.
  • Delegates to the private ADService property (lazily instantiated) to call GetUsersByGroup, then compares each returned member's SAMAccountName to machine, trimming $ suffixes from both sides and comparing case-insensitively.
  • Fails closed: any exception during the AD lookup is caught, logged via Debug.WriteLine, and the method returns false rather than propagating the error or throwing*.
  • The class no longer holds unmanaged resources requiring disposal; Dispose() is retained only to satisfy the IDisposable contract*.

Constraints and usage notes

  • IMachineSecurityService (the interface this class implements) is declared internal, so the concrete MachineSecurityService class is the practical public entry point for downstream consumers*.
  • Callers pass groupName by reference; on return it may reflect the resource-name-convention transformation applied internally.
  • Used internally by EnvironmentServiceBase.IsDeveloperMachine via the private MachineSecurity property, with LDAP/domain values resolved at runtime from Environment API global config settings (ad.ldap.host, ad.ldap.internal.root, ad.internal.domain).

Note: Statements marked with * were inferred from code structure, naming conventions, or contextual evidence where direct confirmation was not available in source artifacts. Statements marked with ** could not be confirmed; treat as unknown until verified.

Sources

  • SAIF.Framework.Security.EnvironmentApi\Core\Services\MachineSecurityService.cs
  • SAIF.Framework.Security.EnvironmentApi\Core\Services\IMachineSecurityService.cs
  • SAIF.Framework.Security.EnvironmentApi\Services.Common\EnvironmentServiceBase.cs