Skip to content

Configuration settings

SAIF.Framework.SecurityModule reads five ConfigurationManager.AppSettings keys to steer its ASP.NET authentication pipeline: error-page routing, host classification, external-login redirect, browser challenge type, and the Windows logon domain. No IEnvironmentService, typed settings with defined values, database connection configuration, or secure-setting retrieval calls were found.

Configuration retrieval methods

Method Class / Interface Namespace Usage pattern
ConfigurationManager.AppSettings clsSecurityModule, UserAuthenticator, TokenProvider SAIF.Framework.SecurityModule Reads request-pipeline settings (sec-errorpage, ExternalHostNames, sec-loginpage, sec-browser-authtype, sec-logindomain) at authentication time.

Environment API settings

None detected.

AppSettings (Web.config)

Settings retrieved via ConfigurationManager.AppSettings.

Setting key Default value Purpose Consuming class Source
sec-errorpage /WebError/ProcessError.aspx (code fallback) Redirect target for unhandled authentication exceptions. clsSecurityModule SAIF.Framework.SecurityModule\clsSecurityModule.vb
ExternalHostNames None declared in this library Case-insensitive host-name catalog used to choose the external vs. internal authentication fallback path. UserAuthenticator SAIF.Framework.SecurityModule\Authenticators\UserAuthenticator.vb
sec-loginpage /onlinelogin/loginscreen.aspx (code fallback) Redirect target for external users when cookie authentication fails. ExternalUserAuthenticator SAIF.Framework.SecurityModule\Authenticators\UserAuthenticator.vb
sec-browser-authtype NTLM (code fallback) Primary WWW-Authenticate scheme used for internal-host browser challenges. InternalUserAuthenticator, BrowserAuthenticator SAIF.Framework.SecurityModule\Authenticators\UserAuthenticator.vb, SAIF.Framework.SecurityModule\Authenticators\BrowserAuthenticator.vb
sec-logindomain None declared in this library Domain argument passed to Win32 LogonUser during cookie-based re-authentication. TokenProvider SAIF.Framework.SecurityModule\TokenProvider.vb

Database connection configuration

None detected.

Secure settings

None detected.

Transitive configuration (from dependencies)

None detected.

Configuration dependencies

Dependency Type Required at Impact if missing
ExternalHostNames appSettings Request-time UserAuthenticator.Find treats every host as internal when the value is empty/missing, so failed cookie authentication falls back to the browser challenge path instead of the external login redirect.
sec-loginpage appSettings Request-time External-user fallback redirects use the built-in /onlinelogin/loginscreen.aspx default when the setting is missing.
sec-browser-authtype appSettings Request-time Browser challenges use the built-in NTLM default when the setting is missing.
sec-logindomain appSettings Request-time TokenProvider passes this value directly to Win32 LogonUser when exchanging cookie credentials for a Windows token; unsuccessful Windows logon raises Unable to login.
sec-errorpage appSettings Request-time Exception redirects use the built-in /WebError/ProcessError.aspx default when the setting is missing.

Sources

  • SAIF.Framework.SecurityModule\clsSecurityModule.vb

  • SAIF.Framework.SecurityModule\Authenticators\UserAuthenticator.vb

  • SAIF.Framework.SecurityModule\Authenticators\BrowserAuthenticator.vb

  • SAIF.Framework.SecurityModule\Authenticators\CookieAuthenticator.vb

  • SAIF.Framework.SecurityModule\TokenProvider.vb

  • SAIF.Framework.SecurityModule\My Project\Settings.settings

  • SAIF.Framework.SecurityModule\My Project\Settings.Designer.vb

  • SAIF.Framework.SecurityModule\SAIF.Framework.SecurityModule.vbproj