Skip to content

Resource authorization check

IsAuthorized is the primary, modern authorization entry point in this library: it turns a base resource name the caller supplies into the environment-specific AD resource identifier the WCF security service expects, then asks that service whether the current principal is a member.

Field Value
Operation ID OP-003
Trigger Caller invokes IsAuthorized
Inputs Base resource name and, optionally, an explicit DevelopmentEnvironment
Outputs Boolean authorization decision
Primary components clsSecurityPrincipal.IsAuthorized, clsSecurityPrincipal.IsAuthorizedSecurityService
Entry point SAIF.Framework.Security\clsSecurityPrincipal.vb

Steps

  1. The single-parameter overload infers whether the current call should be treated as production or non-production from the principal's cached IsProd state, then resolves that into the DevelopmentEnvironment argument the two-parameter overload needs.
  2. Rules enforced: BR-001.
  3. The overload builds Domain\ResourceName with ToFQN, then appends Resource for production or TestResource for every non-production environment — enforcing BR-001 so production and test callers are always checked against distinct AD groups.
  4. Authorization context: the resulting identifier follows the naming convention captured in the AD resource catalog.
  5. IsAuthorizedSecurityService() lazily resolves the securityserviceurl endpoint on first use, constructs a BasicHttpBinding client, and calls SecurityService.SecurityClient.IsAuthorized(m_UserName, RoleName) to obtain the actual decision.
  6. Authorization context: this call is the primary enforcement hop described in Programmatic authorization checks.
  7. On failure: WCF endpoint or transport exceptions are not caught locally, so they propagate to the caller unchanged.

Process flow

The following diagram visualizes this operation's control flow.

flowchart TD
    Start([IsAuthorized called]) --> Env[Resolve environment]
    Env --> Name[Build Domain Resource name]
    Name --> Suffix[Append Resource or TestResource]
    Suffix --> Call[Invoke SecurityService IsAuthorized]
    Call --> Decision{Authorized?}
    Decision -->|Yes| EndOk([Return True])
    Decision -->|No| EndErr([Return False])

Failure and edge-case behavior

  • Non-production callers are always evaluated with the TestResource suffix, never the production Resource suffix, even if the base resource name happens to match.
  • Any WCF service failure propagates directly to the caller; this path has no fail-closed fallback of its own.

Sources

  • SAIF.Framework.Security\clsSecurityPrincipal.vb
  • SAIF.Framework.Security\app.config