SAIF.Presentation.Web.Controls.V2.Menu security and authorization¶

This page documents authorization mechanisms implemented or consumed by this library. Authentication is handled entirely by infrastructure (Windows/IIS integrated authentication) and is not application-level — this library reads the current identity from HttpContext.Current.Request.LogonUserIdentity.Name rather than performing any authentication itself.

Authorization architecture¶

This library performs no authorization decisions of its own. It resolves the current Windows-authenticated identity to construct a per-user NavigationContext, then renders whatever menu/favorite items and toolbar button states that externally supplied, database-backed authorization data (clsMenuAuthorizedItem / clsMenuAuthorizedItemCollection, owned by SAIF.Business.Menu) indicates are authorized for that user*. The library is a pure rendering consumer of an authorization boundary owned outside this library's scope.

flowchart TD
    User[Windows-authenticated user] --> Identity["HttpContext.Current.Request.LogonUserIdentity.Name"]
    Identity --> NavCtx[NavigationContext]
    NavCtx --> AuthItems["clsMenuAuthorizedItemCollection<br>(SAIF.Business.Menu, DB-backed)"]
    AuthItems --> SAIFMenu["SAIFMenu<br>(side panel: apps, categories, favorites)"]
    AuthItems --> SAIFMenuTop["SAIFMenuTop<br>(toolbar: CRUD/print/help buttons)"]

AD resource catalog¶

None. This library does not reference Active Directory groups, System.DirectoryServices, or the WCF SecurityService pattern used elsewhere in the SAIF stack. Menu-item entitlement is sourced from database-driven "security groups" managed entirely within SAIF.Business.Menu (free-text SECURITY_GROUP_TXT values in MENU_SECURITY/MENU_SECURITY_USER), not Windows/AD groups**.

Authorization enforcement points¶

Attribute-based authorization¶

None. No MVC controller actions or declarative [SAIFAuthorize] attributes exist in this library — it is a WebForms server-control library, not a controller library.

Programmatic authorization checks¶

Class	Method	Resource / Role	Check type	Source
`SAIFMenu`	`AddLinks(NavigationData)` / `AddFavorites(NavigationData)`	Per-user authorized menu items and favorites	Rendering filter driven by externally supplied `clsMenuAuthorizedItemCollection`*	`SAIF.Presentation.Web.Controls.V2.Menu\SAIFMenu.vb`
`SAIFMenuTop`	`Page_PreLoad`	Current page's `IsDisplayInsert`/`IsDisplaySave`/`IsDisplayDelete`/`IsDisplayPrint`/`IsDisplayDownload`/`IsDisplaySavePreferences`/`IsDisplayHelp` flags	Toolbar button visibility/enablement driven by externally supplied `clsMenuAuthorizedItem` ("current page") state*	`SAIF.Presentation.Web.Controls.V2.Menu\SAIFMenuTop.vb`

Data-level authorization¶

Entity type	Validation method	Mechanism	Source
Menu item / favorite	`SAIFMenu.AddLinks` / `AddFavorites`	Renders only items present in the current user's `clsMenuAuthorizedItemCollection`, obtained from `NavigationContext` (populated per-user from the database in `SAIF.Business.Menu`, external to this library)*	`SAIF.Presentation.Web.Controls.V2.Menu\SAIFMenu.vb`
Current page / toolbar action	`SAIFMenuTop.Page_PreLoad`	Reads `CurrentPage`/`CurrentItem` (a `clsMenuAuthorizedItem`) via `NavigationContext.GetCurrentPage()` to set per-button visibility/enablement flags*	`SAIF.Presentation.Web.Controls.V2.Menu\SAIFMenuTop.vb`

Segregation of duties¶

None. No segregation-of-duties rules were found in this library's source.

Security interfaces and contracts¶

Interface / Class	Role	Consumers	Source
`NavigationContext`	Resolves the current user's identity and holds the per-user authorized-menu-item collection used to gate rendering	`SAIFMenu`, `SAIFMenuTop`	`SAIF.Presentation.Web.MVC\NavigationContext.vb` (external to this library)
`clsMenuAuthorizedItem` / `clsMenuAuthorizedItemCollection`	Represents the set of menu items, favorites, and per-page action flags a user is entitled to see, populated from the database	`SAIFMenu`, `SAIFMenuTop`	`SAIF.Business.Menu` (external to this library)

Notable security-relevant findings¶

Windows/Integrated authentication dependency: SAIFMenu and SAIFMenuTop both resolve the current user via HttpContext.Current.Request.LogonUserIdentity.Name (stripping the domain prefix before \), implying the hosting application relies on Windows/IIS integrated authentication rather than forms authentication*.
Externally gated Change Password link: SAIFMenu.AddFavorites conditionally renders a "Change Password" favorite link only when AppGlobal.EnvironmentService.IsClientExternal is true, distinguishing internal-network from external-client deployments for which self-service security actions are surfaced*.
Imports SAIF.Framework.Security appears in SAIFMenu.vb, but no explicit type from that namespace is referenced in the visible code — the import may be vestigial or used implicitly through inherited/extension behavior*.
[AspNetHostingPermission] declarative security (CAS): SAIFImageButton is decorated with AspNetHostingPermissionAttribute (SecurityAction.Demand and SecurityAction.InheritanceDemand, both Level:=AspNetHostingPermissionLevel.Minimal) — a legacy Code Access Security declaration limiting the minimum trust level under which the control (and any inheriting class) may run in medium/partial-trust IIS hosting scenarios.
Error/diagnostic exposure risk: SAIFMenu.RenderControl and SAIFMenuTop.RenderControl catch all exceptions during rendering and write ex.Message, ex.Source, and ex.StackTrace directly into the rendered HTML output rather than logging them, which could leak internal implementation details to end users in a production error scenario*.

Inherited security¶

From `NavigationContext` and `clsMenuAuthorizedItem`/`clsMenuAuthorizedItemCollection` (`SAIF.Business.Menu`)¶

Field	Value
Mechanism	Database-table-driven, application-managed "security groups" (`MENU_SECURITY`, `MENU_SECURITY_USER`) — not Active Directory/Windows groups†
Enforcement	`clsMenuAuthorizedItemCollection` retrieves, per user, the set of menu items visible via a SQL join/union against the user's security-group membership, unsecured (public) items, and favorites†
Origin	`SAIF.Business.Menu` — `clsMenuAuthorizedItem`, `clsMenuAuthorizedItemCollection`
Source	Retrieved from indexed documentation via Legends CLI

Notes¶

Note: Statements marked with * were inferred from code structure, naming conventions, or contextual evidence where direct confirmation was not available in source artifacts. Statements marked with ** could not be confirmed; treat as unknown until verified.

Sources¶

SAIF.Presentation.Web.Controls.V2.Menu\SAIFMenu.vb
SAIF.Presentation.Web.Controls.V2.Menu\SAIFMenuTop.vb
SAIF.Presentation.Web.Controls.V2.Menu\SAIFImageButton.vb