---
title: Configuration
summary: Runtime-resolved configuration, the Web.config surface, and per-variant configuration transforms.
status: draft
owner: SAIF Doc Gen
last_reviewed: 2026-09-22
---

# Configuration

Configuration reaches this host through two channels that must not be conflated: a per-request Environment API resolution used by five of the six services, and a small, local `appSettings` read performed only by `SecurityService`. There is no `<connectionStrings>` element anywhere in this host; every database connection is composed at run time from the Environment API and a pool code argument — a SAIF-specific identifier, not the Oracle schema (see the caveat under Runtime-resolved configuration).

## Configuration model

| Aspect | Finding |
| --- | --- |
| Primary mechanism | Environment API resolved per request (`WcfEnvironmentService`) |
| Secondary mechanism | `Web.config` `appSettings`, read directly by `SecurityService` only |
| Resolution timing | Per request — a service instance is constructed per request and reads settings from that request's `OperationContext` |
| `<connectionStrings>` element | Absent |
| Transform files | `Web.Base.config` + `Web.Release.config` (Internal) + `Web.ReleaseExternal.config` (External) |

Five of the six services (`FaxService`, `PreferenceService`, `WebContextService`, `ImagingService`, `SecurityService`) construct `new WcfEnvironmentService(OperationContext.Current.RequestContext)` in their constructor and read every environment setting through `GetConfigSetting`/`GetConfigSetting<T>` on it; because a WCF service instance is created per request under the default instancing, configuration resolution follows the caller's request context rather than a process-wide static. `FileService` reads no configuration at all. Only `SecurityService` additionally reads two keys directly from `System.Configuration.ConfigurationManager.AppSettings`.

## Runtime-resolved configuration

**The pool code argument below is not the Oracle schema.** Each value (`CLM`, `IMG`, `EXTUR`, `NETFRAMEWORK`/`APPM`) is a SAIF-specific pool code forwarded to a legacy connect-info SOAP service (`DbConnectionServiceProxy` → `ConnectInfoSoapClient.GetODPConnectString`, where the argument is passed as `Code`) that resolves the actual Oracle user/schema server-side. The real schema is not visible from application source and must not be inferred from how schema-like the pool code looks.

| Resolution | Call | Constructed from | Returns | Timing | Consumed by |
| --- | --- | --- | --- | --- | --- |
| Environment service | `new WcfEnvironmentService(OperationContext.Current.RequestContext)` | The current WCF request context | Environment track and per-track configuration access | Per request | `FaxService`, `PreferenceService`, `WebContextService`, `ImagingService`, `SecurityService` constructors |
| Oracle connection (pool code `CLM`) | `DbConnectionManager.GetOracleConnectionString(env, EnvironmentConfigKeys.OracleDatabase, "CLM")` | Environment service + pool code (not the Oracle schema — resolved server-side by a legacy connect-info service) | Composed connection string | Per request | `PreferenceService` |
| Oracle connection (pool code `IMG`) | `DbConnectionManager.GetOracleConnectionString(_environmentSvc, EnvironmentConfigKeys.OracleDatabase, "IMG")` | Environment service + pool code (not the Oracle schema — resolved server-side by a legacy connect-info service) | Composed connection string | Per request | `ImagingService` |
| Oracle connection (pool code `EXTUR`) | `DbConnectionManager.GetOracleConnectionString(_environmentService, EnvironmentConfigKeys.OracleDatabase, "EXTUR")` | Environment service + pool code (not the Oracle schema — resolved server-side by a legacy connect-info service) | Composed connection string | Per request | `SecurityService` |
| SQL Server connection (pool codes `NETFRAMEWORK`/`APPM`) | `DbConnectionManager.GetSqlServerConnectionString(env, EnvironmentConfigKeys.NetFrameworkSqlServer, "NETFRAMEWORK", "APPM")` | Environment service + pool codes (not the SQL Server schema — resolved server-side by a legacy connect-info service) | Composed connection string | Per request | `WebContextService` |

| Aspect | Finding |
| --- | --- |
| Caching | Not determined from source — no cache observed around `WcfEnvironmentService` construction or `DbConnectionManager` calls in this host |
| Failure behavior | An Environment API failure during the first per-request configuration read faults the operation — see [Faults and error pipeline](faults.md) |
| Behavior outside a request | Construction throws — `OperationContext.Current` is null outside an active WCF operation |

## Environment API settings

| Key | Retrieved by | Consuming class | Secure | Varies by environment | Purpose |
| --- | --- | --- | --- | --- | --- |
| `EnvironmentConfigKeys.OracleDatabase` | `DbConnectionManager.GetOracleConnectionString` | `PreferenceService`, `ImagingService`, `SecurityService` | No | Yes | Selects the Oracle instance per environment |
| `EnvironmentConfigKeys.NetFrameworkSqlServer` | `DbConnectionManager.GetSqlServerConnectionString` | `WebContextService` | No | Yes | Selects the SQL Server instance per environment |
| `EnvironmentConfigKeys.FaxSoapServiceUrl` | `env.GetConfigSetting(EnvironmentConfigKeys.FaxSoapServiceUrl)` | `FaxService` constructor | No | Yes | Endpoint address passed to `FaxServiceProxy` |
| `EnvironmentConfigKeys.FaxTempStorageFolder` | `env.GetConfigSetting(EnvironmentConfigKeys.FaxTempStorageFolder)` | `FaxService` constructor | No | Unknown | Directory for the transient staged fax document |
| `wcf.authorizationcachesecondstoexpireinternal` | `environmentService.GetConfigSetting<int>("wcf.authorizationcachesecondstoexpireinternal")` | `AuthorizationCacheService.Init` | No | Unknown | Cache TTL in seconds for internal-domain authorization results |
| `wcf.authorizationcachesecondstoexpireexternal` | `environmentService.GetConfigSetting<int>("wcf.authorizationcachesecondstoexpireexternal")` | `AuthorizationCacheService.Init` | No | Unknown | Cache TTL in seconds for external-domain authorization results |
| `wcf.importqueuelocation` | `_environmentSvc.GetConfigSetting("wcf.importqueuelocation")` | `ImagingService.WriteFileWithIdx` | No | Unknown | Root directory of the image import queue |
| `wcf.useobimportpriorityfolders` | `_environmentSvc.GetConfigSetting<bool>("wcf.useobimportpriorityfolders")` | `ImagingService.WriteFileWithIdx` | No | Unknown | Whether to write into a priority subfolder |
| `wcf.lowpriorityfolder` | `_environmentSvc.GetConfigSetting("wcf.lowpriorityfolder")` | `ImagingService.WriteFileWithIdx` | No | Unknown | Subfolder used when the image is system-generated |
| `wcf.medpriorityfolder` | `_environmentSvc.GetConfigSetting("wcf.medpriorityfolder")` | `ImagingService.WriteFileWithIdx` | No | Unknown | Subfolder used when the image is not system-generated |
| `saifbusinesssecurity.userinfo.ad.external.domain` (named by `LDAP_EXTERNAL_KEY`) | `environmentService.GetConfigSetting(ldap_external_key)` | `SecurityService` | No | Unknown | External LDAP host; falls back to a literal default when unresolved — not reproduced here |

## Web.config settings

### appSettings

| Key | Value | Read by | Purpose | Variant |
| --- | --- | --- | --- | --- |
| `LOG_REQUEST_DETAILS` | Not reproduced — see tech debt | `SecurityService` constructor, wrapped in an empty `try`/`catch` | Intended to gate request-detail logging; read but never consulted | Both |
| `LDAP_EXTERNAL_KEY` | Not reproduced — see tech debt | `SecurityService` constructor, wrapped in an empty `try`/`catch` | Names the environment key holding the external LDAP host | Both |
| `FAX_TEMP_LOCATION` | Not reproduced | Declared in `Web.Base.config`; no consumer found in any `.cs` file under `src/WCF` | Superseded by `EnvironmentConfigKeys.FaxTempStorageFolder` resolved through `WcfEnvironmentService` | Both |
| `ApplicationHost` | Not reproduced | Declared in `Web.Base.config`; no consumer found in any `.cs` file under `src/WCF` | Presumed consumed by the external framework closure rather than by host code* | Both |

The transforms touch no `appSettings` key — the base file's values apply identically to both deployment variants.

### system.serviceModel

| Element | Setting | Purpose |
| --- | --- | --- |
| `serviceHostingEnvironment` | `aspNetCompatibilityEnabled="true"`, `multipleSiteBindingsEnabled="true"` | Required so `HttpContext.Current` is available to `SecurityService.LogRequestDetails` and `PreferenceService.GetDefaultPrinter` |
| `services` | 6 `<service>` elements, 0 `<endpoint>` children | Confirms service identity only — activation is entirely route-based; see [Activation and hosting](activation-hosting.md) |
| `bindings` | Unnamed `basicHttpBinding` with `maxBufferPoolSize`/`maxReceivedMessageSize` at `int.MaxValue` and `readerQuotas` (`maxDepth=32`, `maxStringContentLength=5242880`, `maxArrayLength=int.MaxValue`) | Accommodates large file/imaging payloads without per-message size faults |
| `behaviors` | `serviceDebug includeExceptionDetailInFaults="true"`, `serviceMetadata httpGetEnabled="true"` | Fault content and WSDL publication — see [Faults and error pipeline](faults.md) |
| `client` | `<endpoint name="FaxServiceSoap" binding="basicHttpBinding" bindingConfiguration="FaxServiceSoap" contract="Legacy.Fax.FaxServiceSoap">` | Declared but unused — `FaxServiceProxy` builds its outbound binding and endpoint address in code, not from this element; see [Dependencies](dependencies.md) |

### system.web and system.webServer

| Element | Setting | Purpose |
| --- | --- | --- |
| `compilation` | `debug="true" targetFramework="4.6.2"` in the base file; `debug` is removed by both `Release` and `ReleaseExternal` transforms | Target framework and debug compilation |
| `customErrors` | `mode="Off"` | Disables ASP.NET custom error pages (not directly relevant to SOAP fault content, but consistent with `includeExceptionDetailInFaults="true"`) |
| `httpErrors` | `errorMode="Detailed"` | IIS returns detailed error pages for non-SOAP failures |
| `modules` / `httpModules` | `clsSecurityModule`, `ContextLogger` (removed only in the External deployment variant) | See variant differences on [Activation and hosting](activation-hosting.md) |

### Custom configuration sections

| Section | Purpose |
| --- | --- |
| `oracle.manageddataaccess.client` | Oracle managed driver configuration, including `DbProviderFactories` registration for `Oracle.ManagedDataAccess` |

### Assembly binding redirects

| Assembly | Redirected to | Note |
| --- | --- | --- |
| `NHibernate` | 4.0.0.4000 | Aligns the NHibernate reference across the framework closure |
| `Iesi.Collections` | 4.0.0.0 | NHibernate collection dependency |
| `System.Runtime.CompilerServices.Unsafe` | 6.0.0.0 | BCL shim closure |
| `System.Text.Json` | 6.0.0.0 | BCL shim closure |

## Configuration transforms

| Transform file | Build configuration | Deployment variant | Changes applied |
| --- | --- | --- | --- |
| `Web.Base.config` | All | Both | Shared `appSettings`, `system.serviceModel`, and `system.web`/`system.webServer` baseline all transforms apply to |
| `Web.Release.config` | `Release` | Internal | Removes `debug` from `compilation`; leaves `modules`/`httpModules` untouched relative to the base |
| `Web.ReleaseExternal.config` | `ReleaseExternal` | External | Removes `debug` from `compilation`; adds `<remove name="clsSecurityModule" />` and `<remove name="ContextLogger" />` to `modules` and `httpModules` |

## Environment variance

| Setting | DEV | TEST | PROD | Notes |
| --- | --- | --- | --- | --- |
| Environment API values (Oracle/SQL Server instance selection, Legacy.Fax endpoint, LDAP host, cache TTLs) | Not reproduced | Not reproduced | Not reproduced | Pipeline-seeded per environment track through `EnvironmentSettings\settings.yml`; the application reads these through `GetConfigSetting`/`GetConfigSetting<T>` calls named above, not by opening the manifest directly |

## Logging configuration

| Aspect | Finding |
| --- | --- |
| Logging surface | `LogService` (constructed as `new LogService(environmentService)` inside `ErrorLogErrorHandler.HandleError`); IIS log (`HttpContext.Current.Response.AppendToLog`) for `SecurityService.LogRequestDetails` |
| Destination | Not determined from source for `LogService`; the IIS log for request-detail entries |
| Enabled by | Always on for both surfaces — `LOG_REQUEST_DETAILS` is read but never consulted, so it has no effect |
| Configured in | — |

## Related documentation
- [Index](index.md)
- [Overview](overview.md)
- [Architecture](architecture.md)
- [Activation and hosting](activation-hosting.md)
- [Operations](operations.md)
- [Faults and error pipeline](faults.md)
- [Authentication and authorization](authentication-authorization.md)
- [Dependencies](dependencies.md)
- [Operations and processes](operations-processes.md)
- [Business rules](business-rules.md)
- [Data model](data-model.md)
- [Operational runbook](operational-runbook.md)
- [Tech debt](tech-debt.md)

## Sources
- src/WCF/SAIF.Services.WCF.Host/Web.Base.config
- src/WCF/SAIF.Services.WCF.Host/Web.Release.config
- src/WCF/SAIF.Services.WCF.Host/Web.ReleaseExternal.config
- src/WCF/SAIF.Services.WCF.Host/Services/Security/SecurityService.cs
- src/WCF/SAIF.Services.WCF.Host/Services/FaxService.cs
- src/WCF/SAIF.Services.WCF.Host/Services/ImagingService.cs