Skip to content

Resolve SAIF certificate DN

This operation composes the distinguished name (DN) string for the SAIF (non-admin) authentication certificate from configuration-supplied name parts. It is the public counterpart to the DN-resolution logic embedded in Generate SSO handshake payload, but resolves a different configuration key and certificate than the SSO handshake uses.

Field Value
Operation ID OP-EPAY-02
Trigger Caller invokes USBank.GetSAIFCertDistinguishedName()
Inputs None
Outputs DN string (String)
Primary components USBank.GetSAIFCertDistinguishedName, USBank.GetCertificateParameters
Entry point Services\SAIF.Services.WebServices.Epay\WebService\USBank.vb

Steps

  1. Call GetCertificateParameters("usBankEPayAuthenticationCertDN").
  2. GetCertificateParameters reads the usBankEPayAuthenticationCertDN configuration setting via AppGlobal.EnvironmentService.GetConfigSetting and JSON-deserializes the result (JavaScriptSerializer.Deserialize) into a dictionary of DN key/value pairs (BR-003).
  3. Pass the key/value pairs to SAIFCrypto.Certificates.GetDistinguishedName to build the DN string.
  4. Return the DN string to the caller.

The Friend-scoped LoadSAIFCert helper can subsequently load the certificate itself from LocalMachine\My using this DN, but it is not invoked by Generate SSO handshake payload (GetSSOData) in the current code — GetSSOData resolves and loads a separate certificate (the SAIF admin authentication certificate, via usBankEPayAuthenticationAdminCertDN) instead.* No other caller of GetSAIFCertDistinguishedName or LoadSAIFCert was found in this library.**

Process flow

The following diagram visualizes this operation's control flow.

flowchart TD
    Start([Start: GetSAIFCertDistinguishedName]) --> Config[Read usBankEPayAuthenticationCertDN<br>config setting]
    Config --> Deserialize[JSON-deserialize into<br>DN key/value pairs]
    Deserialize --> BuildDN[Build DN string via<br>SAIFCrypto.Certificates.GetDistinguishedName]
    BuildDN --> End([Return DN string])

Failure and edge-case behavior

  • If the usBankEPayAuthenticationCertDN configuration key is missing or its value is malformed JSON, JavaScriptSerializer.Deserialize throws inside GetCertificateParameters, and no DN string is returned.
  • This operation only builds the DN string; it does not load the certificate from the certificate store itself. The Friend-scoped LoadSAIFCert helper performs the load using this DN, but is not called from GetSSOData in the current code, so this operation's output has no confirmed active consumer within this library.*

Note: Statements marked with * were inferred from code structure, naming conventions, or contextual evidence where direct confirmation was not available in source artifacts. Statements marked with ** could not be confirmed; treat as unknown until verified.

Sources

  • Services\SAIF.Services.WebServices.Epay\WebService\USBank.vb