---
title: Role or group membership check
summary: Evaluates role or group membership for the current principal through the WCF SecurityService path.
status: draft
owner: <owner>
last_reviewed: 2026-07-30
library: SAIF.Framework.Security
reference_type: package
operation_id: OP-004
trigger: Caller invokes `IsInRole`
---

# Role or group membership check

`IsInRole` answers a narrower question than resource authorization: whether the current principal belongs to a specific AD role or group. It normalizes whatever role name the caller supplies into fully qualified `Domain\Role` form, then hands off to the same WCF enforcement call that resource checks use, without applying an environment suffix.

| Field | Value |
| --- | --- |
| **Operation ID** | OP-004 |
| **Trigger** | Caller invokes `IsInRole` |
| **Inputs** | Role name (bare or fully qualified) |
| **Outputs** | Boolean membership decision |
| **Primary components** | `clsSecurityPrincipal.IsInRole`, `clsSecurityPrincipal.IsAuthorizedSecurityService` |
| **Entry point** | `SAIF.Framework.Security\clsSecurityPrincipal.vb` |

## Steps

1. `IsInRole()` parses the supplied name with `FromFQN` to determine whether it already carries a domain qualifier.
2. If the name is already qualified, it is sent to the service unchanged; otherwise the method prefixes it with the current principal's own domain via `ToFQN`, enforcing [BR-005](../business-rules.md#br-005-unqualified-role-names-are-domain-qualified-before-an-isinrole-check) so a bare role name is never evaluated against the wrong domain.
   - Authorization context: this normalization step prepares the identifier that [Programmatic authorization checks](../security-authorization.md#programmatic-authorization-checks) evaluate.
3. The normalized value is passed to `IsAuthorizedSecurityService()`, which resolves the WCF endpoint on demand and calls `SecurityService.SecurityClient.IsAuthorized(m_UserName, RoleName)` — the identical service call used by resource authorization.
   - Authorization context: this is a programmatic enforcement point listed in [Authorization enforcement points](../security-authorization.md#authorization-enforcement-points).
   - On failure: WCF service exceptions are not caught locally and propagate to the caller.

## Process flow

The following diagram visualizes this operation's control flow.

```mermaid
flowchart TD
	Start([IsInRole called]) --> FQN{Already qualified?}
	FQN -->|Yes| Direct[Use supplied role]
	FQN -->|No| Prefix[Prefix current domain]
	Direct --> Call[Invoke SecurityService IsAuthorized]
	Prefix --> Call
	Call --> Decision{In role?}
	Decision -->|Yes| EndOk([Return True])
	Decision -->|No| EndErr([Return False])
```

## Failure and edge-case behavior

- A bare role name is always qualified with the current principal's domain before it reaches the WCF call; unlike resource checks, no `Resource`/`TestResource` suffix is ever applied here.
- Service failures propagate unchanged because this method adds no local exception handling.

## Related documentation
- [Operations and processes](../operations-processes.md)
- [Business rules](../business-rules.md)
- [Security and authorization](../security-authorization.md)

## Sources
- `SAIF.Framework.Security\clsSecurityPrincipal.vb`