---
title: MachineSecurityService
summary: API reference for MachineSecurityService.
status: draft
owner: <owner>
last_reviewed: 2026-07-23
library: SAIF.Framework.Security
reference_type: package
---

# MachineSecurityService

`MachineSecurityService` authorizes a machine/service account (as opposed to an interactive user) against an AD security group, for scenarios such as batch jobs or server-to-server calls authenticating with a computer account. It implements `IMachineSecurityService`.

## Purpose
- Validate whether a named machine/service account is a member of an AD security group by enumerating group membership via the WCF `SecurityService` and matching in-process.

## Context
- Namespace: `SAIF.Framework.Security.Utilities`
- Assembly/package: `SAIF.BOF.Framework.Security` (bundled into the repository-wide `SAIF.BOF.Framework` NuGet package)

## Public members
| Member | Signature | Purpose |
| --- | --- | --- |
| `New` | `Sub New(Optional ldap As String = "LDAP://slmdc01.corp.saif.com:389/DC=corp,DC=saif,DC=com", Optional domain As String = "saif", Optional recurse As Boolean = True)` | Constructs the service, resolving the WCF endpoint URL via a `CustomEnvironmentService` hard-coded to `CustomEnvironment.Prod`. |
| `IsAuthorized` | `Function IsAuthorized(machine As String, ByRef groupName As String, Optional isResource As Boolean = True, Optional useProductionSecurityResource As Boolean = True) As Boolean` | Implements `IMachineSecurityService.IsAuthorized`. Optionally suffixes `groupName`, calls `SecurityService.SecurityClient.GetUsersByGroup`, and matches `machine` case-insensitively against the returned members. See [BR-003](../../business-rules.md#br-003-machine-security-group-names-use-testresource-suffixing) and [BR-008](../../business-rules.md#br-008-machine-authorization-fails-closed-on-service-error). |
| `Dispose` | `Sub Dispose()` | Implements `IDisposable.Dispose`. No unmanaged resources currently require disposal; retained to fulfill the `IDisposable` contract. |

## Behavioral notes
- Fails closed: if the underlying `GetUsersByGroup` WCF call throws, the exception is logged via `Debug.WriteLine` only, and the method returns `False` (not-authorized). See [BR-008](../../business-rules.md#br-008-machine-authorization-fails-closed-on-service-error).
- Resolves its environment/config settings via a `CustomEnvironmentService` instance hard-coded to `CustomEnvironment.Prod`, distinct from the `AppGlobal.EnvironmentService` singleton used by `clsSecurityPrincipal` — the two classes also read the same logical config key (`securityServiceUrl` vs. `securityserviceurl`) under different casings.*
- No SAMAccountName `$`-suffix stripping logic is present; the `machine` parameter is compared as-is against whatever strings `GetUsersByGroup` returns.**

## Constraints and usage notes
- Default LDAP root is `LDAP://slmdc01.corp.saif.com:389/DC=corp,DC=saif,DC=com`; default domain is `saif`; group-membership recursion defaults to `True` — all overridable via constructor parameters.
- `groupName` is passed `ByRef` and mutated in place when `isResource=True` (the suffix is appended to the caller's variable).
- Whether the WCF service itself normalizes a trailing `$` on computer account names is unknown from this repository.**

> **Note:** Statements marked with * were inferred from code structure, naming conventions, or
> contextual evidence where direct confirmation was not available in source artifacts. Statements
> marked with ** could not be confirmed; treat as unknown until verified.

## Sources
- `SAIF.Framework.Security\Utilities\MachineSecurityService.vb`