Skip to content

SAIF.Framework.Security business rules

This page captures business rules enforced by this library.

BR-001: WCF resource names are environment-suffixed

Field Value
Statement AD resource names are environment-suffixed (Resource for Prod, TestResource otherwise) before being sent to the WCF SecurityService.
Trigger Any IsAuthorized(ResourceName) / IsAuthorized(ResourceName, Env) call.
Enforcement clsSecurityPrincipal.IsAuthorized (SAIF.Framework.Security\clsSecurityPrincipal.vb:288-296).
Outcome Production and non-production environments are authorized against distinct AD groups, preventing cross-environment privilege bleed.
Source SAIF.Framework.Security\clsSecurityPrincipal.vb

BR-002: Legacy ASMX resource checks use a plain Test suffix

Field Value
Statement Legacy AD resource checks append a plain Test suffix (not TestResource) in non-production.
Trigger Any call to clsAccountMaintProxy.ResourceAccessValid* or GetWhoHasAccess.
Enforcement clsAccountMaintProxy.vb (multiple methods, e.g., SAIF.Framework.Security\clsAccountMaintProxy.vb:107-115).
Outcome Legacy ASMX-based checks use a different (inconsistent) naming convention than the WCF-based IsAuthorized path — same underlying business intent (environment isolation) but a different suffix format.
Source SAIF.Framework.Security\clsAccountMaintProxy.vb

BR-003: Machine security group names use Test+Resource suffixing

Field Value
Statement Machine security group/resource names append Test then Resource suffixes when isResource=True and useProductionSecurityResource=False.
Trigger MachineSecurityService.IsAuthorized call.
Enforcement SAIF.Framework.Security\Utilities\MachineSecurityService.vb:20-24.
Outcome Machine/service-account authorization also respects environment isolation, matching the WCF IsAuthorized convention rather than the legacy ASMX convention.
Source SAIF.Framework.Security\Utilities\MachineSecurityService.vb

BR-004: ASPNET and anonymous identities are never authenticated on Web

Field Value
Statement A user is not considered authenticated on the Web platform if the resolved identity is anonymous or is the built-in ASPNET account.
Trigger InitWindowsIdentity during clsSecurityPrincipal construction.
Enforcement SAIF.Framework.Security\clsSecurityPrincipal.vb:172-186.
Outcome Prevents the framework from treating the ASP.NET worker process identity as an authenticated end user.
Source SAIF.Framework.Security\clsSecurityPrincipal.vb

BR-005: Unqualified role names are domain-qualified before an IsInRole check

Field Value
Statement Role names not already in Domain\Role FQN form are qualified using the current principal's own domain before the role check.
Trigger IsInRole(RoleName) call with an unqualified role name.
Enforcement SAIF.Framework.Security\clsSecurityPrincipal.vb:308-318 (FromFQN/ToFQN).
Outcome Ensures role/group lookups are always domain-qualified when sent to the SecurityService.
Source SAIF.Framework.Security\clsSecurityPrincipal.vb

BR-006: Changing identity properties logs the principal out

Field Value
Statement Changing UserName, Domain, or Password on an existing clsSecurityPrincipal instance immediately logs the principal out (clears authenticated state, un-impersonates).
Trigger Setting UserName, Domain, or Password property.
Enforcement SAIF.Framework.Security\clsSecurityPrincipal.vb:70-91 (property setters) calling Logout() (SAIF.Framework.Security\clsSecurityPrincipal.vb:325-334).
Outcome Prevents stale authorization/impersonation state from persisting after credentials are changed.
Source SAIF.Framework.Security\clsSecurityPrincipal.vb

BR-007: Internal network addresses are limited to a fixed prefix set

Field Value
Statement Internal network addresses are recognized only for 10.*, 127.0.0.1, and ::1 prefixes.*
Trigger clsEnvironment.InternalAddress(Address) call.
Enforcement SAIF.Framework.Security\clsEnvironment.vb.
Outcome Provides a coarse internal-vs-external network classification used by callers (e.g., to select internal vs. external authorization paths).*
Source SAIF.Framework.Security\clsEnvironment.vb

BR-008: Machine authorization fails closed on service error

Field Value
Statement Utilities.MachineSecurityService.IsAuthorized fails closed (returns not-authorized) when the underlying WCF GetUsersByGroup call throws, since the exception handler only logs via Debug.WriteLine and never sets the result to found.
Trigger Any exception raised while calling SecurityService.SecurityClient.GetUsersByGroup.
Enforcement SAIF.Framework.Security\Utilities\MachineSecurityService.vb:29-36.
Outcome Guarantees a safe default (not-authorized) if the WCF endpoint is unreachable or throws, at the cost of silently swallowing the underlying error detail.
Source SAIF.Framework.Security\Utilities\MachineSecurityService.vb

Notes

  • Mark inferred statements with * and unknown statements with **. Do not use bold inline confidence labels.
  • No stored-procedure or database-backed business rules exist for this library; it performs no database access of any kind.

Note: Statements marked with * were inferred from code structure, naming conventions, or contextual evidence where direct confirmation was not available in source artifacts.

Sources

  • SAIF.Framework.Security\clsSecurityPrincipal.vb
  • SAIF.Framework.Security\clsAccountMaintProxy.vb
  • SAIF.Framework.Security\Utilities\MachineSecurityService.vb
  • SAIF.Framework.Security\clsEnvironment.vb