Skip to content

SAIF.Framework.Security dependencies

Internal dependencies

Dependency Type Usage
SAIF.Framework.Security.EnvironmentApi Internal Referenced via <ProjectReference> in SAIF.BOF.Framework.Security.vbproj. Supplies EnvironmentServiceBase, WebEnvironmentService, WindowsEnvironmentService, CustomEnvironmentService, ApplicationEnvironment, and IEnvironmentService.GetConfigSetting, consumed throughout this library (e.g., AppGlobal.vb, Utilities\MachineSecurityService.vb:18). See Configuration for the concrete Environment API keys and transitive EnvironmentApi requirements this library relies on.

External dependencies

Dependency Version Usage
WCF SecurityService (Service Reference) N/A (WSDL-generated proxy) Primary/modern authorization and user-lookup endpoint. Client class SecurityService.SecurityClient, generated from Service References\SecurityService\Reference.vb, SecurityService.wsdl, and Security*.xsd. Configured endpoint address http://saifonline/WCF/Security via basicHttpBinding (app.config:45,55); URL also resolved at runtime from the securityserviceurl/securityServiceUrl config key. Called by clsSecurityPrincipal.IsAuthorizedSecurityService (IsAuthorized) and Utilities.MachineSecurityService.IsAuthorized (GetUsersByGroup).
Legacy ASMX clsADServices (Web Reference) N/A (WSDL-generated proxy) Legacy AD web service retained for backward compatibility during migration. Generated from Web References\ADServices\Reference.vb, clsadservices.wsdl, clsadservices.disco. Exposes HasAccess, HasAccessExternal, HasAccessCache, HasAccessCacheExternal, WhoHasAccessCache, GetUserInfo, GetUserInfoExternal, GetEMailAddress, GetIDNumber, GetLastLogon, and payment-password/menu-cache methods. Called by clsAccountMaintProxy and by clsSecurityPrincipal.GetEmailAddress/GetIDNumber/GetDefaultPrinter. URL resolved from the legacyADServiceUrl config key.
System.DirectoryServices Framework-standard (BCL) Imported in clsSecurityPrincipal.vb; namespace imported only, no direct DirectoryEntry/DirectorySearcher usage found in live code.*
System.Security.Principal Framework-standard (BCL) WindowsIdentity, WindowsPrincipal, GenericPrincipal used for identity capture.
System.ServiceModel / System.ServiceModel.Description Framework-standard (BCL) WCF client construction for the SecurityService path.
System.Web / System.Web.Security Framework-standard (BCL) FormsAuthentication, HttpContext, HttpCookie used for Forms-identity initialization and login cookie handling.
System.Runtime.InteropServices Framework-standard (BCL) P/Invoke declarations (advapi32.dll, Kernel32.dll, crypt32.dll) for impersonation and DPAPI.
System.Security.Cryptography / System.Security.Cryptography.X509Certificates Framework-standard (BCL) AES, MD5, and X.509 certificate operations in Cryptography\.
System.EnterpriseServices / System.Runtime.Serialization Framework-standard (BCL) Referenced assemblies; no direct usage observed in scanned files.**
Newtonsoft.Json N/A Declared via <Import Include="Newtonsoft.Json" /> in the project file; no direct JSON serialization call found in live code scanned.**

API dependencies

Endpoint Method Called from Purpose
WCF SecurityService (http://saifonline/WCF/Security) IsAuthorized clsSecurityPrincipal.IsAuthorizedSecurityService Resource/role authorization decision for the current principal.
WCF SecurityService (http://saifonline/WCF/Security) GetUsersByGroup Utilities.MachineSecurityService.IsAuthorized Enumerate AD group membership for in-process machine-account matching.
WCF SecurityService (http://saifonline/WCF/Security) IsAuthorized2, GetUser, GetSaifUserByUserId, GetUserIdForEmployeeId, GetSaifUserByEmployeeId, GetExternalUser, GetInjuredWorkerUserByCustomerId, GetExternalUserByCustomerId Declared on the contract; not invoked from this library's own code (available for consuming applications).* User-lookup and dual-domain authorization operations.
Legacy clsADServices.asmx HasAccess / HasAccessExternal clsAccountMaintProxy.ResourceAccessValid/ResourceAccessValidExternal Legacy resource-access authorization check (internal/external domain).
Legacy clsADServices.asmx HasAccessCache / HasAccessCacheExternal clsAccountMaintProxy.ResourceAccessValidCached/ResourceAccessValidCachedExternal Legacy cached resource-access authorization check.
Legacy clsADServices.asmx WhoHasAccessCache clsAccountMaintProxy.GetWhoHasAccess Enumerate members with access to a resource.
Legacy clsADServices.asmx GetEMailAddress / GetIDNumber / menu-cache methods clsSecurityPrincipal.GetEmailAddress/GetIDNumber/GetDefaultPrinter Legacy directory attribute lookups.

Dependency risks and notes

  • In-progress migration, dual endpoints: The library maintains two parallel external authorization integrations — the modern WCF SecurityService and the legacy ASMX clsADServices — with no single path fully retired. IsAuthorized/IsInRole/MachineSecurityService use the WCF endpoint, while clsAccountMaintProxy and select clsSecurityPrincipal methods (GetEmailAddress, GetIDNumber, GetDefaultPrinter) still depend on the legacy ASMX endpoint.* Consumers must be aware which path a given method uses, since the two are not interchangeable.
  • Inconsistent environment-suffix conventions across paths: The WCF path appends Resource/TestResource to resource/role names, while the legacy ASMX path (clsAccountMaintProxy) appends only a plain Test suffix — same environment-isolation intent, different naming format, creating a risk of misconfiguration if a resource is provisioned under one convention but queried under the other.
  • Inconsistent config-key casing/resolution for the same WCF endpoint: clsSecurityPrincipal reads securityserviceurl via the AppGlobal.EnvironmentService singleton, while Utilities.MachineSecurityService reads securityServiceUrl via its own CustomEnvironmentService instance hard-coded to CustomEnvironment.Prod — this is the same logical setting resolved by two different code paths with different casing and different environment awareness. Whether the underlying config-key lookup is case-insensitive is not verified from this library's source.**
  • Fail-closed behavior differs by design, not enforced consistently: Utilities.MachineSecurityService.IsAuthorized swallows exceptions from the WCF call (Debug.WriteLine only) and falls through to a not-authorized result, which is a safe fail-closed behavior but is not something documented or guaranteed for the other authorization entry points (clsSecurityPrincipal.IsAuthorized/IsInRole).
  • No static AD resource/group catalog: All resource, role, and group names are caller-supplied strings; this library ships no fixed policy data, so any resource-naming risk (e.g., typos, suffix mismatches) originates in consuming applications, not here.
  • Machine account $-suffix normalization is unverified: No trailing $ stripping logic (typical for SAMAccountName computer accounts) exists in Utilities.MachineSecurityService; whether the WCF service normalizes this server-side is unknown from this repository.**
  • Declared but unused dependencies: System.EnterpriseServices, System.Runtime.Serialization, and Newtonsoft.Json are referenced in the project file but show no direct usage in the scanned live code, representing potential dead weight in the dependency footprint.**

Note: Statements marked with * were inferred from code structure, naming conventions, or contextual evidence where direct confirmation was not available in source artifacts. Statements marked with ** could not be confirmed; treat as unknown until verified.

Sources

  • SAIF.Framework.Security\SAIF.BOF.Framework.Security.vbproj
  • SAIF.Framework.Security\clsSecurityPrincipal.vb
  • SAIF.Framework.Security\clsAccountMaintProxy.vb
  • SAIF.Framework.Security\AppGlobal.vb
  • SAIF.Framework.Security\Utilities\MachineSecurityService.vb
  • SAIF.Framework.Security\Utilities\IMachineSecurityService.vb
  • SAIF.Framework.Security\Service References\SecurityService\Reference.vb
  • SAIF.Framework.Security\Web References\ADServices\Reference.vb
  • SAIF.Framework.Security\app.config