UserAuthenticator¶

UserAuthenticator is an abstract (MustInherit) base class that defines the authenticator strategy contract and provides two shared static helpers: authenticator selection by host classification (Find) and the already-authenticated short-circuit check (IsAuthenticated). The concrete subclasses ExternalUserAuthenticator and InternalUserAuthenticator are declared in the same source file and implement the internal/external fallback behavior.

Purpose¶

Provide a factory (Find) that selects the appropriate concrete authenticator based on host classification (see BR-002).
Define the abstract Authenticate(WebContext) contract implemented by ExternalUserAuthenticator and InternalUserAuthenticator.
Provide the shared IsAuthenticated check used to short-circuit re-authentication (see BR-001).

Context¶

Namespace: SAIF.Framework.SecurityModule
Assembly/package: SAIF.Framework.SecurityModule (packaged inside the SAIF.BOF.Framework NuGet package)

Public members¶

Member	Signature	Purpose
`Find`	`Public Shared Function Find(host As String, externalHostNames As String) As UserAuthenticator`	Classifies `host` against `externalHostNames` (case-insensitive substring match) and returns a new `ExternalUserAuthenticator` or `InternalUserAuthenticator` instance.
`IsAuthenticated`	`Public Shared Function IsAuthenticated(user As IPrincipal) As Boolean`	Returns `true` when `user` is non-null and `user.Identity.IsAuthenticated` is `true`.
`Authenticate`	`Public MustOverride Sub Authenticate(WebContext As HttpApplication)`	Abstract contract implemented by `ExternalUserAuthenticator` and `InternalUserAuthenticator` to perform the concrete authentication attempt and fallback.

ExternalUserAuthenticator (subclass)¶

Member	Signature	Purpose
`LoginPage`	`Public ReadOnly Property LoginPage As String`	Configured login page URL (`sec-loginpage` app setting), defaulting to `/onlinelogin/loginscreen.aspx`.
`Authenticate`	`Public Overrides Sub Authenticate(WebContext As HttpApplication)`	Attempts `CookieAuthenticator.Authenticate`; on failure, redirects the response to `LoginPage`.

InternalUserAuthenticator (subclass)¶

Member	Signature	Purpose
`Authenticate`	`Public Overrides Sub Authenticate(WebContext As HttpApplication)`	Attempts `CookieAuthenticator.Authenticate`; on failure, invokes `BrowserAuthenticator.Authenticate` with the `sec-browser-authtype` setting.

Behavioral notes¶

Find performs an uppercase-normalized substring match (If(externalHostNames, "").ToUpper().Contains(host.ToUpper())), not an exact host-name comparison — any configured entry containing the host as a substring (or vice versa, since Contains is called on the settings string) causes external classification.*
Both concrete subclasses delegate their cookie-authentication attempt to the shared static CookieAuthenticator.Authenticate method before applying their distinct fallback.

Constraints and usage notes¶

UserAuthenticator cannot be instantiated directly (MustInherit); callers obtain an instance exclusively via Find.
IsAuthenticated and Find are Shared (static) members and do not require an instance.

Note: Statements marked with * were inferred from code structure, naming conventions, or contextual evidence where direct confirmation was not available in source artifacts.

Sources¶

SAIF.Framework.SecurityModule\Authenticators\UserAuthenticator.vb