Skip to content

Authorize a machine or service account

This operation is the library's general-purpose primitive for deciding whether a machine or service account belongs to an AD group. It optionally rewrites the requested group name to the SAIF resource-group convention, retrieves the effective membership for that group, compares normalized account names, and fails closed whenever the AD lookup itself fails.

Field Value
Operation ID OP-ENV-007
Trigger Caller requests machine or service-account authorization
Inputs machine, groupName, isResource, isProductionResource, recurse
Outputs Authorization bool and possibly rewritten groupName
Primary components MachineSecurityService.IsAuthorized
Entry point SAIF.Framework.Security.EnvironmentApi\Core\Services\MachineSecurityService.cs

Steps

  1. If isResource is true, rewrite groupName to the SAIF resource convention: append Test first for non-production requests, then append Resource (BR-007).
  2. Initialize the result to false so the method fails closed by default and only flips to true once membership is positively confirmed.
  3. Retrieve the effective group membership from AD using the configured LDAP path, domain, and the caller's recursion setting.
  4. Open the target domain context.
  5. Resolve the group's distinguished name.
  6. Enumerate nested groups (when requested) and direct users.

Origin: Step 3 is expanded in Enumerate AD group membership, which supplies the member list this step consumes. 4. Iterate the returned member names and compare machine.Trim('$') to each member.Trim('$') case-insensitively, returning true as soon as the first match is found (BR-006). 5. If the AD lookup throws any exception, write the exception message to Debug, leave the result at false, and return that fail-closed decision rather than letting the exception escape.

Process flow

The following diagram visualizes this operation's control flow.

flowchart TD
    Start([Caller requests machine authorization]) --> Resource{Resource-group rewrite needed?}
    Resource -->|Yes| Rewrite[Append Test and or Resource suffixes]
    Resource -->|No| Members[Read AD membership]
    Rewrite --> Members
    Members --> Match{Normalized machine found?}
    Match -->|Yes| Allow([Return true])
    Match -->|No| Deny([Return false])
    Members -. exception .-> Deny

Failure and edge-case behavior

  • Group-name rewriting mutates the caller's groupName argument in place because it is passed by reference — callers should inspect the returned value if they need the resolved group name.
  • Exceptions raised during the AD lookup never propagate; they are logged to Debug and treated as an authorization failure.
  • Account-name comparisons ignore case and trim trailing $ characters from both sides before comparing, so machine and service accounts compare consistently regardless of their AD-formatted suffix.

Sources

  • SAIF.Framework.Security.EnvironmentApi\Core\Services\MachineSecurityService.cs
  • SAIF.Framework.Security.EnvironmentApi\Core\Services\ADService.cs