Skip to content

Legacy resource membership enumeration

Rather than answering a yes/no authorization question, this operation returns the full list of accounts that currently have access to a legacy resource — useful for auditing or troubleshooting access issues. It goes through the same legacy ASMX AD service as the resource-access checks and applies the same non-production Test suffix convention.

Field Value
Operation ID OP-007
Trigger Caller invokes GetWhoHasAccess
Inputs Base resource name
Outputs Member account array
Primary components clsAccountMaintProxy.GetWhoHasAccess, GetADService
Entry point SAIF.Framework.Security\clsAccountMaintProxy.vb

Steps

  1. The method resolves a clsADServices proxy through GetADService(), reusing the same legacy endpoint-resolution logic as the other clsAccountMaintProxy operations.
  2. In production, the method calls WhoHasAccessCache(resourceName) directly with the base resource name; in non-production, it first appends the plain Test suffix — enforcing the same BR-002 convention used by legacy access checks.
  3. Authorization context: this operation is useful for authorization troubleshooting and visibility, but it is not itself listed as an enforcement point in Authorization enforcement points — it only reports membership, it does not decide access.
  4. The array returned by the ASMX service is passed straight back to the caller with no local transformation.
  5. On failure: any service exception propagates because the method does not catch it locally.

Process flow

The following diagram visualizes this operation's control flow.

flowchart TD
    Start([Membership list requested]) --> Proxy[Create clsADServices proxy]
    Proxy --> Env{Production?}
    Env -->|Yes| CallProd[Call WhoHasAccessCache]
    Env -->|No| CallTest[Append Test and call]
    CallProd --> EndOk([Return member array])
    CallTest --> EndOk

Failure and edge-case behavior

  • Non-production requests use the legacy plain Test suffix, matching the convention used elsewhere in clsAccountMaintProxy.
  • The method performs no filtering or transformation of the service response — callers receive the raw member array exactly as the ASMX service returned it.
  • Service failures propagate unchanged to the caller.

Sources

  • SAIF.Framework.Security\clsAccountMaintProxy.vb