OP-016: Authorize a user for a role with caller-controlled domain order¶
IsAuthorized2 is invoked over the Security route on SAIF.Services.WCF.Services.Security.SecurityService; this page documents the process end to end, from route dispatch to the message the caller receives.
Field
Value
Operation ID
OP-016
Trigger
Caller invokes IsAuthorized2 over the Security route, or IsAuthorized calls it internally with tryInternalDomainFirst = true.
Constructor reads LOG_REQUEST_DETAILS and LDAP_EXTERNAL_KEY from appSettings inside an empty catch, resolves the external LDAP host with a literal fallback, opens the Oracle EXTUR unit of work, constructs UserFactory, and calls AuthorizationCacheService.Init when the cache is not ready (BR-WCF-018, BR-WCF-029).
LogRequestDetails appends the operation name and its arguments — including userId and role — to the IIS log (BR-WCF-032).
Enforce.ArgumentNotNullOrWhiteSpace on userId and role; the third guard passes role under the label "domain", so domain is never actually validated (BR-WCF-023).
When tryInternalDomainFirst is true, the internal check runs first and the external check only on a false internal answer; when false, the order is reversed under the same cache/exception rules (BR-WCF-030, BR-WCF-031).
AuthorizationCacheService.IsAuthorized caches the outcome as described above (BR-WCF-029).
Return the boolean.
On failure: directory exceptions other than the two handled SecurityException shapes are logged by the installed error handler and surfaced as a generic SOAP fault with exception detail included.
The following diagram visualizes this process's control flow.
flowchart TD
A["Initialize dependencies and<br>authorization cache"]
B["Log request details"]
C["Validate userId and role"]
D1{"tryInternalDomainFirst"}
D2["Internal check runs first,<br>then the external check runs<br>only on a false internal answer<br>(same cache/exception rules)"]
D3["External check runs first,<br>then the internal check runs<br>only on a false external answer<br>(same cache/exception rules)"]
E["Cache the authorization outcome"]
F["Return the boolean."]
A --> B
B --> C
C --> D1
D1 -->|"true"| D2
D1 -->|"false"| D3
D2 --> E
D3 --> E
E --> F
Note: Statements marked with * were inferred from code structure, naming
conventions, or contextual evidence where direct confirmation was not available
in source artifacts. Statements marked with ** could not be confirmed; treat
as unknown until verified.