SAIF.Framework.Security security and authorization¶

This page documents authorization mechanisms implemented or consumed by this library. Authentication is handled entirely by infrastructure (NTLM/AD) and is not application-level for consuming applications; however, because this library is the framework's identity/authentication primitives layer rather than a consuming application, its authentication-adjacent mechanisms (Authenticate(), InitWindowsIdentity/InitFormsIdentity, impersonation) are noted here for completeness even though authentication itself is out of scope for authorization documentation.*

Authorization architecture¶

This library implements a dual-path programmatic authorization architecture: a primary, actively-used path that delegates resource and role checks to a centralized WCF SecurityService, and a legacy path that calls a parallel ASMX clsADServices web service for resource-access checks and directory lookups not yet migrated. No AD resource or group names are hard-coded anywhere in this library — all resource/role/group names are caller-supplied strings; this is a mechanism layer, not a policy owner. No MVC [SAIFAuthorize] attributes, data-level ownership validators, or segregation-of-duties rules exist here.

flowchart TD
    Caller[Consuming application] --> Principal[clsSecurityPrincipal /<br>clsSecurityPrincipalCOM]
    Caller --> MachineSvc[Utilities.MachineSecurityService]
    Caller --> AccountProxy[clsAccountMaintProxy]
    Principal -->|IsAuthorized / IsInRole| WCFSvc[WCF SecurityService]
    MachineSvc -->|GetUsersByGroup| WCFSvc
    AccountProxy -->|HasAccess / HasAccessCache /<br>HasAccessExternal / HasAccessCacheExternal| ADSvc[(Legacy clsADServices.asmx)]

AD resource catalog¶

No static AD group/resource names are hard-coded anywhere in this library. All resource/role/group names are caller-supplied at runtime — consuming applications pass the base resource name as a string argument, and this library appends the environment suffix and performs the lookup.

Resource name	Purpose	Enforcement point	Source
`<caller-supplied base name>`	Base resource name passed by the calling application; suffixed `Resource` (Prod) or `TestResource` (non-Prod), then sent as `Domain\ResourceName<Suffix>` to the WCF `SecurityService`	`clsSecurityPrincipal.IsAuthorized(ResourceName)`	`SAIF.Framework.Security\clsSecurityPrincipal.vb`
`<caller-supplied role/resource name>`	Passed as `RoleName`; used as-is if already fully-qualified (`Domain\Name`), otherwise the current principal's domain is prefixed — no `Resource`/`TestResource` suffix is appended in this path	`clsSecurityPrincipal.IsInRole(RoleName)`	`SAIF.Framework.Security\clsSecurityPrincipal.vb`
`<caller-supplied group name>`	Base machine/service-account group name; suffix `Test`+`Resource` or `Resource` appended per `useProductionSecurityResource` flag	`Utilities.MachineSecurityService.IsAuthorized(machine, groupName, isResource, useProductionSecurityResource)`	`SAIF.Framework.Security\Utilities\MachineSecurityService.vb`
`<caller-supplied resource name>`	Legacy ASMX path; no suffixing logic present in the proxy itself (a plain `Test` suffix is applied one layer up, in `clsAccountMaintProxy`)	`ADServices.HasAccess` / `HasAccessExternal` / `HasAccessCache` / `HasAccessCacheExternal` / `WhoHasAccessCache`	`SAIF.Framework.Security\Web References\ADServices\Reference.vb`

Authorization enforcement points¶

This library exposes programmatic authorization enforcement points only — there are no MVC [SAIFAuthorize]/[SaifAuthorize] attributes here; this is the framework/plumbing layer consumed by such attributes in application repositories, not an MVC application itself.

Programmatic authorization checks¶

Class	Method	Resource / Role	Check type	Source
`clsSecurityPrincipal`	`IsAuthorized(ResourceName As String)`	`ResourceName` (base name; env-aware overload)	`IsAuthorized`	`SAIF.Framework.Security\clsSecurityPrincipal.vb:239-247`
`clsSecurityPrincipal`	`IsAuthorized(ResourceName As String, Env As DevelopmentEnvironment)`	`ResourceName` + explicit environment	`IsAuthorized`	`SAIF.Framework.Security\clsSecurityPrincipal.vb:249-263`
`clsSecurityPrincipal`	`IsInRole(RoleName As String)`	`RoleName` (FQN or bare)	`IsInRole`	`SAIF.Framework.Security\clsSecurityPrincipal.vb:284-293`
`clsSecurityPrincipal`	`IsAuthorizedSecurityService(RoleName As String)`	Fully-qualified resource/role string (central WCF dispatch used by the checks above)	`IsAuthorized`	`SAIF.Framework.Security\clsSecurityPrincipal.vb:295-305`
`clsSecurityPrincipalCOM`	`IsAuthorized(Resource As String)`	`Resource` (COM-visible wrapper delegating to `clsSecurityPrincipal.IsAuthorized`)	`IsAuthorized`	`SAIF.Framework.Security\clsSecurityPrincipalCOM.vb:24-26`
`clsSecurityPrincipalCOM`	`IsInRole(Role As String)`	`Role` (COM-visible wrapper delegating to `clsSecurityPrincipal.IsInRole`)	`IsInRole`	`SAIF.Framework.Security\clsSecurityPrincipalCOM.vb:29-31`
`Utilities.MachineSecurityService`	`IsAuthorized(machine, groupName, isResource, useProductionSecurityResource)`	`groupName` (suffixed `Resource`/`TestResource` when `isResource=True`)	`HasAccess` (group-membership enumeration + in-process match, not a boolean service call)	`SAIF.Framework.Security\Utilities\MachineSecurityService.vb:20-38`
`ADServices.clsADServices`	`HasAccess(mailid, resourcename)`	`resourcename` (internal domain)	`HasAccess`	`SAIF.Framework.Security\Web References\ADServices\Reference.vb:364-390`
`ADServices.clsADServices`	`HasAccessExternal(mailid, resourcename)`	`resourcename` (external domain)	`HasAccess`	`SAIF.Framework.Security\Web References\ADServices\Reference.vb:391-417`
`ADServices.clsADServices`	`HasAccessCache(mailid, resourcename)`	`resourcename` (cached, internal domain)	`HasAccess`	`SAIF.Framework.Security\Web References\ADServices\Reference.vb:418-444`
`ADServices.clsADServices`	`HasAccessCacheExternal(mailid, resourcename)`	`resourcename` (cached, external domain)	`HasAccess`	`SAIF.Framework.Security\Web References\ADServices\Reference.vb:472-498`

Not counted as an authorization enforcement point: ADServices.clsADServices.WhoHasAccessCache / clsAccountMaintProxy.GetWhoHasAccess — this enumerates group members rather than making a yes/no authorization decision (SAIF.Framework.Security\clsAccountMaintProxy.vb:98-105).

Security interfaces and contracts¶

Interface / Class	Role	Consumers	Source
`Utilities.IMachineSecurityService`	Contract for machine/service-account AD group authorization (`IsAuthorized`)	`Utilities.MachineSecurityService`	`SAIF.Framework.Security\Utilities\IMachineSecurityService.vb`
`clsSecurityPrincipal`	De facto security-manager/principal type: identity capture, NTLM authentication, and WCF authorization dispatch (does not implement a named `ISecurityManager`-style interface)*	`clsSecurityPrincipalCOM`, `clsSAIFLoginInfo`, consuming applications	`SAIF.Framework.Security\clsSecurityPrincipal.vb`
`clsSecurityPrincipalCOM`	COM-visible authorization wrapper for non-.NET/legacy Windows clients	External COM clients (consumers outside this repository)**	`SAIF.Framework.Security\clsSecurityPrincipalCOM.vb`

No ISecurityManager, IClaimSecurityManager, IDomainSecurityManager, SecurityManager, DomainSecurityManagerBase, or ClaimSecurityManager types were found in this library.

Notes¶

Mark inferred statements with * and unknown statements with **. Do not use bold inline confidence labels.
AD resource names listed here use base names only. The framework appends Resource (production) or TestResource (non-production) at runtime via the WCF path; the legacy ASMX path (clsAccountMaintProxy) appends only a plain Test suffix, an inconsistent convention relative to the WCF path.
Data-level authorization, segregation-of-duties (SOD) rules, and attribute-based ([SAIFAuthorize]) enforcement were all searched for and not found in this library (counts: 0 for each).

Note: Statements marked with * were inferred from code structure, naming conventions, or contextual evidence where direct confirmation was not available in source artifacts. Statements marked with ** could not be confirmed; treat as unknown until verified.

Sources¶

SAIF.Framework.Security\clsSecurityPrincipal.vb
SAIF.Framework.Security\clsSecurityPrincipalCOM.vb
SAIF.Framework.Security\clsAccountMaintProxy.vb
SAIF.Framework.Security\Utilities\MachineSecurityService.vb
SAIF.Framework.Security\Utilities\IMachineSecurityService.vb
SAIF.Framework.Security\Service References\SecurityService\Reference.vb
SAIF.Framework.Security\Web References\ADServices\Reference.vb
SAIF.Framework.Security\app.config