--- title: SAIF.Framework.Security.EnvironmentApi configuration settings summary: Configuration keys consumed by this library, retrieval methods, and runtime dependencies. status: draft owner: last_reviewed: 2026-07-23 library: SAIF.Framework.Security.EnvironmentApi reference_type: package --- # Configuration settings `SAIF.Framework.Security.EnvironmentApi` implements the framework's configuration abstraction itself. Its own runtime behavior reads six Environment API setting keys, two local `ConfigurationManager.AppSettings` overrides, and one required OS environment variable (`EnvironmentApiUrl`); it also exposes secure-setting retrieval APIs, but no internal call site in this library invokes `GetSecureConfigSetting(...)`. ## Configuration retrieval methods | Method | Class / Interface | Namespace | Usage pattern | | --- | --- | --- | --- | | Environment API cached settings download | `EnvironmentServiceBase` | `SAIF.Framework.Security` | `RefreshConfigurationIfNewer()` downloads `/v2/settings/{ApplicationId}/{ApplicationHost}/...`, caches the payload, and serves `GetConfigSetting(...)` / `GetConfigSetting(...)`. | | Environment API global-setting lookup | `EnvironmentServiceBase` | `SAIF.Framework.Security` | `GetGlobalConfigSetting(...)` calls `/v2/setting/{ApplicationId}/global/{configKey}/value` to bootstrap LDAP/domain values for developer-machine checks. | | ConfigurationManager.AppSettings | `EnvironmentServiceBase` | `SAIF.Framework.Security` | Reads `EnvApiDeveloperSettingsOverride` and `ApplicationHost` from local config for developer-machine overrides. | | OS environment variable | `EnvironmentServiceBase` | `SAIF.Framework.Security` | Reads `EnvironmentApiUrl` from the process environment before any Environment API HTTP request. | | Environment API secure-setting endpoint | `EnvironmentServiceBase` | `SAIF.Framework.Security` | Exposes `GetSecureConfigSetting(...)` / `GetSecureConfigSetting(...)` against `/v2/secureSetting/...`; no internal consumer was found in this library. | ## Environment API settings Settings retrieved via `IEnvironmentService` (centralized environment configuration service). | Setting key | Method | Data type | Purpose | Consuming class | Source | | --- | --- | --- | --- | --- | --- | | `ad.ldap.host` | `GetGlobalConfigSetting` | URL/path prefix | LDAP host/root prefix used to assemble the directory path for developer-machine AD authorization checks. | `EnvironmentServiceBase` | `SAIF.Framework.Security.EnvironmentApi\Services.Common\EnvironmentServiceBase.cs` | | `ad.ldap.internal.root` | `GetGlobalConfigSetting` | DN/path fragment | Internal LDAP root appended to `ad.ldap.host` for developer-machine AD authorization checks. | `EnvironmentServiceBase` | `SAIF.Framework.Security.EnvironmentApi\Services.Common\EnvironmentServiceBase.cs` | | `ad.internal.domain` | `GetGlobalConfigSetting` | Domain name | Active Directory domain passed to `MachineSecurityService` / `ADService` for developer-machine authorization checks. | `EnvironmentServiceBase` | `SAIF.Framework.Security.EnvironmentApi\Services.Common\EnvironmentServiceBase.cs` | | `checkforupdatedsettingsinseconds` | Settings payload lookup | Integer | Refresh-throttle interval loaded from the downloaded settings payload after each full cache refresh. | `EnvironmentServiceBase` | `SAIF.Framework.Security.EnvironmentApi\Services.Common\EnvironmentServiceBase.cs` | | `internalAddressRoots` | `GetConfigSetting` | Comma-delimited IP prefixes | Prefix list used by `WebEnvironmentService` to classify callers as external vs. internal. | `WebEnvironmentService` | `SAIF.Framework.Security.EnvironmentApi\Services.Common\WebEnvironmentService.cs` | | `insideFirewallAddressRoots` | `GetConfigSetting` | Comma-delimited IP prefixes | Prefix list used by `WebEnvironmentService` to classify callers as inside the firewall. | `WebEnvironmentService` | `SAIF.Framework.Security.EnvironmentApi\Services.Common\WebEnvironmentService.cs` | ## AppSettings (Web.config) Settings retrieved via `ConfigurationManager.AppSettings`. | Setting key | Default value | Purpose | Consuming class | Source | | --- | --- | --- | --- | --- | | `EnvApiDeveloperSettingsOverride` | None declared in this library | Relative or absolute JSON file path for developer-machine local setting overrides. | `EnvironmentServiceBase` | `SAIF.Framework.Security.EnvironmentApi\Services.Common\EnvironmentServiceBase.cs` | | `ApplicationHost` | None declared in this library | Developer-machine host override used by `WebEnvironmentService`, `WindowsEnvironmentService`, and `WcfEnvironmentService`. | `EnvironmentServiceBase` | `SAIF.Framework.Security.EnvironmentApi\Services.Common\EnvironmentServiceBase.cs` | ## Database connection configuration None detected. ## Secure settings None detected. `GetSecureConfigSetting(...)` and `GetSecureConfigSetting(...)` are implemented here, but no internal call site in this library retrieves a specific secure key. ## Transitive configuration (from dependencies) None detected. ## Configuration dependencies | Dependency | Type | Required at | Impact if missing | | --- | --- | --- | --- | | `EnvironmentApiUrl` | OS environment variable | Startup / runtime | `EnvironmentServiceBase` throws `MissingEnvironmentUrlVariableException` before any Environment API-backed lookup can proceed. | | `checkforupdatedsettingsinseconds` | Environment API setting | Runtime | `RefreshConfigurationIfNewer()` throws `KeyNotFoundException` after downloading settings if the refresh-throttle key is absent. | | `ad.ldap.host`, `ad.ldap.internal.root`, `ad.internal.domain` | Environment API global settings | Runtime (developer-machine detection) | `EnvironmentServiceBase` cannot build the LDAP path/domain context required for `IsDeveloperMachine` authorization checks. | | `internalAddressRoots` | Environment API setting | Request-time (web hosts) | `WebEnvironmentService.IsClientExternal` cannot evaluate the caller's IP-prefix classification. | | `insideFirewallAddressRoots` | Environment API setting | Request-time (web hosts) | `WebEnvironmentService.IsClientInsideFirewall` cannot evaluate the caller's IP-prefix classification. | ## Related documentation - [Library index](index.md) - [Overview](overview.md) - [Architecture](architecture.md) - [Dependencies](dependencies.md) - [Operations and processes](operations-processes.md) - [Business rules](business-rules.md) - [Security and authorization](security-authorization.md) - [API reference](api/index.md) ## Sources - `SAIF.Framework.Security.EnvironmentApi\Services.Common\EnvironmentServiceBase.cs` - `SAIF.Framework.Security.EnvironmentApi\Services.Common\WebEnvironmentService.cs` - `SAIF.Framework.Security.EnvironmentApi\Services.Common\WindowsEnvironmentService.cs` - `SAIF.Framework.Security.EnvironmentApi\Services.Common\WcfEnvironmentService.cs` - `SAIF.Framework.Security.EnvironmentApi\Services.Common\CustomEnvironmentService.cs` - `SAIF.Framework.Security.EnvironmentApi\Services.Common\OfficeAddinEnvironmentService.cs` - `SAIF.Framework.Security.EnvironmentApi\Services.Common\EnvironmentConfigKeys.cs` - `SAIF.Framework.Security.EnvironmentApi\Services.Common\SystemHashUtil.cs` - `SAIF.Framework.Security.EnvironmentApi\Core\Contracts\Core\Configurations\ConfigurationSettings.cs` - `SAIF.Framework.Security.EnvironmentApi\Core\Services\MachineSecurityService.cs` - `SAIF.Framework.Security.EnvironmentApi\Core\Services\ADService.cs` - `SAIF.Framework.Security.EnvironmentApi\Core\Services\SecurityServiceClient.cs` - `SAIF.Framework.Security.EnvironmentApi\Core\Services\IEnvironmentService.cs` - `SAIF.Framework.Security.EnvironmentApi\Exceptions\MissingEnvironmentUrlVariableException.cs` - `SAIF.Framework.Security.EnvironmentApi\app.config` - `SAIF.Framework.Security.EnvironmentApi\SAIF.BOF.Framework.Security.EnvironmentApi.csproj`