Skip to content

Role or group membership check

IsInRole answers a narrower question than resource authorization: whether the current principal belongs to a specific AD role or group. It normalizes whatever role name the caller supplies into fully qualified Domain\Role form, then hands off to the same WCF enforcement call that resource checks use, without applying an environment suffix.

Field Value
Operation ID OP-004
Trigger Caller invokes IsInRole
Inputs Role name (bare or fully qualified)
Outputs Boolean membership decision
Primary components clsSecurityPrincipal.IsInRole, clsSecurityPrincipal.IsAuthorizedSecurityService
Entry point SAIF.Framework.Security\clsSecurityPrincipal.vb

Steps

  1. IsInRole() parses the supplied name with FromFQN to determine whether it already carries a domain qualifier.
  2. If the name is already qualified, it is sent to the service unchanged; otherwise the method prefixes it with the current principal's own domain via ToFQN, enforcing BR-005 so a bare role name is never evaluated against the wrong domain.
  3. Authorization context: this normalization step prepares the identifier that Programmatic authorization checks evaluate.
  4. The normalized value is passed to IsAuthorizedSecurityService(), which resolves the WCF endpoint on demand and calls SecurityService.SecurityClient.IsAuthorized(m_UserName, RoleName) — the identical service call used by resource authorization.
  5. Authorization context: this is a programmatic enforcement point listed in Authorization enforcement points.
  6. On failure: WCF service exceptions are not caught locally and propagate to the caller.

Process flow

The following diagram visualizes this operation's control flow.

flowchart TD
    Start([IsInRole called]) --> FQN{Already qualified?}
    FQN -->|Yes| Direct[Use supplied role]
    FQN -->|No| Prefix[Prefix current domain]
    Direct --> Call[Invoke SecurityService IsAuthorized]
    Prefix --> Call
    Call --> Decision{In role?}
    Decision -->|Yes| EndOk([Return True])
    Decision -->|No| EndErr([Return False])

Failure and edge-case behavior

  • A bare role name is always qualified with the current principal's domain before it reaches the WCF call; unlike resource checks, no Resource/TestResource suffix is ever applied here.
  • Service failures propagate unchanged because this method adds no local exception handling.

Sources

  • SAIF.Framework.Security\clsSecurityPrincipal.vb