---
title: SAIF.Framework.Security overview
summary: High-level purpose, scope, and responsibilities for the SAIF.Framework.Security library.
status: draft
owner: <owner>
last_reviewed: 2026-07-23
library: SAIF.Framework.Security
reference_type: package
---

# SAIF.Framework.Security overview

> **Documentation context:** Packaged Component (NuGet)
>
> This library's source is bundled into the repository-wide `SAIF.BOF.Framework` NuGet package via the `SAIF.Framework.Core\SAIF.BOF.Framework.Core.nuspec` wildcard `<file>` glob (`..\**\*.vb;..\**\*.cs`), independent of any `<ProjectReference>` chain.*

`SAIF.Framework.Security` is the framework-level security primitives library for SAIF BOF applications. It provides identity capture/impersonation, delegates resource and role authorization decisions to a centralized WCF `SecurityService`, retains a legacy ASMX `clsADServices` integration path for backward compatibility, and offers general-purpose cryptography helpers used by login and credential flows.

## Purpose
- Provide the mechanisms consuming applications use to capture the current Windows/Forms identity, authenticate via NTLM, and impersonate the resulting principal.
- Delegate resource/role authorization decisions to a centralized WCF `SecurityService`, while retaining a legacy ASMX `clsADServices` path for account lookups and resource-access checks not yet migrated.
- Authorize machine/service accounts against AD security groups for batch/server-to-server scenarios.
- Supply standalone cryptography helpers (DPAPI, AES, MD5, X.509) consumed by login/credential flows.
- Expose a COM-visible authorization wrapper for legacy, non-.NET Windows clients.

## Responsibilities
- Identity capture and impersonation for Web (Forms/Windows) and Windows-application platforms.
- Programmatic resource and role authorization dispatch to the WCF `SecurityService`.
- Legacy resource-access checks and directory lookups via the ASMX `clsADServices` proxy.
- Machine/service-account AD group-membership authorization.
- Environment/configuration resolution shared across both integration paths.
- Cryptography utilities (DPAPI, AES, MD5, X.509 certificate operations).
- Login orchestration, including encrypted "automated login" credential round-trips.

## Key components
- `clsSecurityPrincipal`: Core security principal — identity capture, NTLM authentication, and WCF `SecurityService` authorization dispatch.
- `clsSecurityPrincipalCOM`: COM-visible wrapper delegating to `clsSecurityPrincipal`.
- `clsAccountMaintProxy`: Legacy ASMX `clsADServices` account/resource-access proxy.
- `Utilities.MachineSecurityService` (`IMachineSecurityService`): Machine/service-account AD group authorization.
- `clsElevateImpersonate` / `SAIFCredentials`: Win32 impersonation for explicit-credential scenarios.
- `clsSAIFLoginInfo`: Login orchestration and encrypted automated-login cookie management.
- `AppGlobal`: Environment/config resolution boundary.
- `Cryptography\` (`AES`, `Certificates`, `MD5Hash`) and `DAPIEncrypt.vb` (`DPAPI`): Standalone cryptography utilities.

## Related documentation
- [Index](index.md)
- [Architecture](architecture.md)
- [Dependencies](dependencies.md)
- [Operations and processes](operations-processes.md)
- [Business rules](business-rules.md)
- [Configuration](configuration.md)
- [Security and authorization](security-authorization.md)
- [API reference](api/index.md)

> **Note:** Statements marked with * were inferred from code structure, naming conventions, or
> contextual evidence where direct confirmation was not available in source artifacts.

## Sources
- `SAIF.Framework.Security\SAIF.BOF.Framework.Security.vbproj`
- `SAIF.Framework.Security\clsSecurityPrincipal.vb`
- `SAIF.Framework.Security\clsAccountMaintProxy.vb`
- `SAIF.Framework.Security\Utilities\MachineSecurityService.vb`
- `SAIF.Framework.Core\SAIF.BOF.Framework.Core.nuspec`