---
title: Resource authorization check
summary: Evaluates resource access for the current principal through the WCF SecurityService path.
status: draft
owner: <owner>
last_reviewed: 2026-07-30
library: SAIF.Framework.Security
reference_type: package
operation_id: OP-003
trigger: Caller invokes `IsAuthorized`
---

# Resource authorization check

`IsAuthorized` is the primary, modern authorization entry point in this library: it turns a base resource name the caller supplies into the environment-specific AD resource identifier the WCF security service expects, then asks that service whether the current principal is a member.

| Field | Value |
| --- | --- |
| **Operation ID** | OP-003 |
| **Trigger** | Caller invokes `IsAuthorized` |
| **Inputs** | Base resource name and, optionally, an explicit `DevelopmentEnvironment` |
| **Outputs** | Boolean authorization decision |
| **Primary components** | `clsSecurityPrincipal.IsAuthorized`, `clsSecurityPrincipal.IsAuthorizedSecurityService` |
| **Entry point** | `SAIF.Framework.Security\clsSecurityPrincipal.vb` |

## Steps

1. The single-parameter overload infers whether the current call should be treated as production or non-production from the principal's cached `IsProd` state, then resolves that into the `DevelopmentEnvironment` argument the two-parameter overload needs.
   - Rules enforced: [BR-001](../business-rules.md#br-001-wcf-resource-names-are-environment-suffixed).
2. The overload builds `Domain\ResourceName` with `ToFQN`, then appends `Resource` for production or `TestResource` for every non-production environment — enforcing [BR-001](../business-rules.md#br-001-wcf-resource-names-are-environment-suffixed) so production and test callers are always checked against distinct AD groups.
   - Authorization context: the resulting identifier follows the naming convention captured in the [AD resource catalog](../security-authorization.md#ad-resource-catalog).
3. `IsAuthorizedSecurityService()` lazily resolves the `securityserviceurl` endpoint on first use, constructs a `BasicHttpBinding` client, and calls `SecurityService.SecurityClient.IsAuthorized(m_UserName, RoleName)` to obtain the actual decision.
   - Authorization context: this call is the primary enforcement hop described in [Programmatic authorization checks](../security-authorization.md#programmatic-authorization-checks).
   - On failure: WCF endpoint or transport exceptions are not caught locally, so they propagate to the caller unchanged.

## Process flow

The following diagram visualizes this operation's control flow.

```mermaid
flowchart TD
	Start([IsAuthorized called]) --> Env[Resolve environment]
	Env --> Name[Build Domain Resource name]
	Name --> Suffix[Append Resource or TestResource]
	Suffix --> Call[Invoke SecurityService IsAuthorized]
	Call --> Decision{Authorized?}
	Decision -->|Yes| EndOk([Return True])
	Decision -->|No| EndErr([Return False])
```

## Failure and edge-case behavior

- Non-production callers are always evaluated with the `TestResource` suffix, never the production `Resource` suffix, even if the base resource name happens to match.
- Any WCF service failure propagates directly to the caller; this path has no fail-closed fallback of its own.

## Related documentation
- [Operations and processes](../operations-processes.md)
- [Business rules](../business-rules.md)
- [Security and authorization](../security-authorization.md)

## Sources
- `SAIF.Framework.Security\clsSecurityPrincipal.vb`
- `SAIF.Framework.Security\app.config`