---
title: SAIF.Framework.Security configuration settings
summary: Configuration keys consumed by this library, retrieval methods, and runtime dependencies.
status: draft
owner: <owner>
last_reviewed: 2026-07-23
library: SAIF.Framework.Security
reference_type: package
---

# Configuration settings

`SAIF.Framework.Security` resolves three runtime setting keys through `SAIF.Framework.Security.EnvironmentApi` (`legacyADServiceUrl`, `securityserviceurl`, and `securityServiceUrl`) and also carries one typed `applicationSettings` URL for the generated legacy AD web-service proxy. No direct `ConfigurationManager.AppSettings` or secure-setting retrieval calls were found in this library.

## Configuration retrieval methods

| Method | Class / Interface | Namespace | Usage pattern |
| --- | --- | --- | --- |
| Environment API (`GetConfigSetting`) | `EnvironmentServiceBase` via `AppGlobal.EnvironmentService` / `CustomEnvironmentService` | `SAIF.Framework.Security` | `clsAccountMaintProxy`, `clsSecurityPrincipal`, and `Utilities.MachineSecurityService` resolve runtime service endpoints through `GetConfigSetting(...)`. |
| ApplicationSettingsBase (`MySettings`) | `My.MySettings` via generated `ADServices.clsADServices` proxy | `SAIF.Framework.Security.My` / `SAIF.Framework.Security.ADServices` | The generated ASMX proxy constructor initializes `Url` from `MySettings.Default.SAIF_Framework_Security_ADServices_clsADServices`. |

## Environment API settings

Settings retrieved via `IEnvironmentService` (centralized environment configuration service).

| Setting key | Method | Data type | Purpose | Consuming class | Source |
| --- | --- | --- | --- | --- | --- |
| `legacyADServiceUrl` | `GetConfigSetting` | URL | Base URL for the legacy `clsADServices` ASMX proxy used for resource checks and directory lookups. | `clsAccountMaintProxy`, `clsSecurityPrincipal` | `SAIF.Framework.Security\clsAccountMaintProxy.vb`, `SAIF.Framework.Security\clsSecurityPrincipal.vb` |
| `securityserviceurl` | `GetConfigSetting` | URL | WCF `SecurityService` endpoint address used by `clsSecurityPrincipal.IsAuthorizedSecurityService`. | `clsSecurityPrincipal` | `SAIF.Framework.Security\clsSecurityPrincipal.vb` |
| `securityServiceUrl` | `GetConfigSetting` | URL | WCF `SecurityService` endpoint address used by `Utilities.MachineSecurityService`. | `Utilities.MachineSecurityService` | `SAIF.Framework.Security\Utilities\MachineSecurityService.vb` |

## AppSettings (Web.config)

None detected. This library does not call `ConfigurationManager.AppSettings`; the generated AD web-service proxy instead uses an `applicationSettings` typed setting.

## Database connection configuration

None detected.

## Secure settings

None detected.

## Transitive configuration (from dependencies)

| Setting key | Method | Source dependency | Dependency type | Purpose |
| --- | --- | --- | --- | --- |
| `EnvironmentApiUrl` | `Environment.GetEnvironmentVariable` | `SAIF.Framework.Security.EnvironmentApi` | `ProjectReference` | Base URL for all Environment API HTTP calls made before this library can resolve `legacyADServiceUrl`, `securityserviceurl`, or `securityServiceUrl`. |
| `checkforupdatedsettingsinseconds` | Environment API settings payload lookup | `SAIF.Framework.Security.EnvironmentApi` | `ProjectReference` | Required refresh-throttle key in the Environment API response cache that backs every `GetConfigSetting(...)` call. |
| `ApplicationHost` | `ConfigurationManager.AppSettings` | `SAIF.Framework.Security.EnvironmentApi` | `ProjectReference` | Optional developer-machine host override used by `WebEnvironmentService`, `WindowsEnvironmentService`, and `WcfEnvironmentService` when resolving the Environment API host. |
| `EnvApiDeveloperSettingsOverride` | `ConfigurationManager.AppSettings` | `SAIF.Framework.Security.EnvironmentApi` | `ProjectReference` | Optional developer-machine JSON override file path checked before the Environment API cache. |
| `ad.ldap.host` | `GetGlobalConfigSetting` | `SAIF.Framework.Security.EnvironmentApi` | `ProjectReference` | LDAP host/root prefix used when `EnvironmentServiceBase` evaluates developer-machine AD membership. |
| `ad.ldap.internal.root` | `GetGlobalConfigSetting` | `SAIF.Framework.Security.EnvironmentApi` | `ProjectReference` | Internal LDAP root appended to `ad.ldap.host` for developer-machine AD membership checks. |
| `ad.internal.domain` | `GetGlobalConfigSetting` | `SAIF.Framework.Security.EnvironmentApi` | `ProjectReference` | AD domain used to create the `PrincipalContext` for developer-machine authorization checks. |

## Configuration dependencies

| Dependency | Type | Required at | Impact if missing |
| --- | --- | --- | --- |
| `legacyADServiceUrl` | Environment API setting | Runtime | Legacy ASMX account/resource-access calls cannot set `clsADServices.Url`, so `clsAccountMaintProxy` and `clsSecurityPrincipal` cannot target the intended AD web service. |
| `securityserviceurl` | Environment API setting | Runtime | `clsSecurityPrincipal.IsAuthorizedSecurityService` cannot build the WCF `EndpointAddress` for authorization checks. |
| `securityServiceUrl` | Environment API setting | Runtime | `Utilities.MachineSecurityService` cannot construct its WCF `SecurityClient` endpoint. |
| `EnvironmentApiUrl` | OS environment variable | Startup / runtime | `EnvironmentServiceBase` throws `MissingEnvironmentUrlVariableException` before Environment API-backed lookups complete. |
| `checkforupdatedsettingsinseconds` | Environment API setting | Runtime | `EnvironmentServiceBase.RefreshConfigurationIfNewer` throws `KeyNotFoundException` after downloading settings if the refresh-throttle key is absent. |
| `SAIF_Framework_Security_ADServices_clsADServices` | `applicationSettings` typed setting | Runtime | The generated `clsADServices` proxy defaults its `Url` property from this typed setting when callers instantiate the proxy before overriding `Url`. |

## Related documentation

- [Library index](index.md)

- [Overview](overview.md)

- [Architecture](architecture.md)

- [Dependencies](dependencies.md)

- [Operations and processes](operations-processes.md)

- [Business rules](business-rules.md)

- [Security and authorization](security-authorization.md)

- [API reference](api/index.md)

## Sources

- `SAIF.Framework.Security\AppGlobal.vb`

- `SAIF.Framework.Security\clsAccountMaintProxy.vb`

- `SAIF.Framework.Security\clsSecurityPrincipal.vb`

- `SAIF.Framework.Security\Utilities\MachineSecurityService.vb`

- `SAIF.Framework.Security\My Project\Settings.settings`

- `SAIF.Framework.Security\My Project\Settings.Designer.vb`

- `SAIF.Framework.Security\Web References\ADServices\Reference.vb`

- `SAIF.Framework.Security\app.config`

- `SAIF.Framework.Security\SAIF.BOF.Framework.Security.vbproj`

- `SAIF.Framework.Security.EnvironmentApi\Services.Common\EnvironmentServiceBase.cs`

- `SAIF.Framework.Security.EnvironmentApi\Services.Common\WebEnvironmentService.cs`

- `SAIF.Framework.Security.EnvironmentApi\Services.Common\WindowsEnvironmentService.cs`

- `SAIF.Framework.Security.EnvironmentApi\Services.Common\WcfEnvironmentService.cs`