---
title: SAIF.Presentation.Web.MVC security and authorization
summary: Authorization requirements, AD resource groups, security enforcement points, and data-level access control.
status: draft
owner: SAIF Documentation Team
last_reviewed: 2026-08-17
library: SAIF.Presentation.Web.MVC
reference_type: package
---

# SAIF.Presentation.Web.MVC security and authorization

This page documents authorization mechanisms implemented or consumed by this library. This library consumes `clsSecurityPrincipal` (an external type from `SAIF.BOF.Framework`) for authentication-state checks and performs challenge/deny handling based on its `.IsAuthenticated` result; it does not itself implement an authentication mechanism. The upstream authentication implementation that populates `clsSecurityPrincipal` (commonly infrastructure-level NTLM/AD in SAIF deployments) is not established by this library's source and is marked as unknown below.**

## Authorization architecture

Authorization in this library is local/programmatic only — there is no centralized WCF `SecurityService` call, no `[SAIFAuthorize]`/`[SaifAuthorize]` attribute usage, and no direct AD/`PrincipalContext`/`DirectoryEntry` code anywhere in this library. Two independent, coarse-grained programmatic checks run unconditionally on every request from `clsControllerBase.Initialize()`: (1) `SecurityCheck()` verifies an authenticated principal is present, and (2) `RedirectUnauthorizedUsers()` gates page access using a database-provisioned, per-user menu entitlement lookup (`NavigationContext.IsMenuItem`) rather than named AD resource groups.

```mermaid
flowchart TD
    Browser[Browser request] --> Init[clsControllerBase.Initialize]
    Init --> SecCheck[SecurityCheck]
    SecCheck -->|No principal, clsEnvironment.InternalAddress true| Challenge[HTTP 401 NTLM/Basic challenge]
    SecCheck -->|No principal, clsEnvironment.InternalAddress false| Deny[Throw Not Authorized]
    SecCheck -->|Authenticated| NavBuild[Build/reuse NavigationContext in Session navdata]
    NavBuild --> MenuLookup[NavigationContext.IsMenuItem]
    MenuLookup -->|Not authorized| Redirect[Clear navdata, redirect to OnlineLogin/LoginScreen.aspx]
    MenuLookup -->|Authorized| Continue[Continue request pipeline]
    NavBuild --> MenuDB[(SAIF.Business.Menu data<br>Oracle, via clsMSOracleDataLayer)]
```

## AD resource catalog

No AD group ("Resource") names, LDAP filters, or `IsAuthorized(resourceName, env)`-style calls are referenced anywhere in this library's own source. `clsSecurityPrincipal` is consumed only as an opaque, already-authenticated identity/principal holder (`.IsAuthenticated`, `.UserName`) — it is an external framework type defined in `SAIF.BOF.Framework`, and no resource-name string literals are passed to it from this library.

| Resource name | Purpose | Enforcement point | Source |
| --- | --- | --- | --- |
| *(none found)* | — | — | — |

Page-level access is instead governed by database-driven menu authorization data (see the "Programmatic authorization checks" and "Data-level authorization" sections below) rather than named AD resources referenced directly in this library's code.

## Authorization enforcement points

### Attribute-based authorization

None found. No `AuthorizeAttribute`-derived custom attributes, `[SaifAuthorize]`/`<SAIFAuthorize>` decorations, or `AuthorizeCore` overrides exist in this library.

### Programmatic authorization checks

| Class | Method | Resource / Role | Check type | Source |
| --- | --- | --- | --- | --- |
| `clsControllerBase` | `SecurityCheck()` | None (no resource/role parameter) | Presence/authentication check — verifies `Model.Context.SecurityPrincipal` is populated; constructs a `clsSecurityPrincipal(Platform.Web)` and checks `.IsAuthenticated`. If authenticated, caches the principal on context and sets an `STYPE` cookie to the username. If not authenticated: callers for which the external `clsEnvironment.InternalAddress(Request.UserHostAddress)` check (a `SAIF.BOF.Framework` dependency, distinct from the local `IsInsideClient` property behind [BR-MVC-008](business-rules.md#br-mvc-008-internal-address-classification)) returns `True` receive an HTTP 401 with `WWW-Authenticate: NTLM`/`Basic` challenge headers and the response ends; otherwise an `Exception("Not Authorized.")` is thrown. | SAIF.Presentation.Web.MVC\clsControllerBase.vb |
| `clsControllerBase` | `RedirectUnauthorizedUsers()` | Menu item, keyed by `(currentApp, currentItem)` derived from the request URL path | Menu-driven, data-backed page authorization (redirect-on-deny) — retrieves the per-user `NavigationContext` cached in `Session("navdata")` and calls `navData.IsMenuItem(currentApp, currentItem)`. If the page is not found in the user's authorized menu set, the session's cached nav data is cleared and the request is redirected to `/OnlineLogin/LoginScreen.aspx`; a warning is traced. This is enforced by [BR-MVC-002](business-rules.md#br-mvc-002-menu-based-page-authorization) and acts as the page/URL-level authorization gate for the whole request pipeline. | SAIF.Presentation.Web.MVC\clsControllerBase.vb |
| `clsControllerBase` | `Initialize()` | N/A (orchestration) | Orchestrates the two checks above on every request, in order: session-timeout redirect ([BR-MVC-001](business-rules.md#br-mvc-001-session-timeout-redirect)) → `SecurityCheck()` → (lazily build/cache `NavigationContext` for the user in `Session("navdata")` if absent) → `RedirectUnauthorizedUsers()`. No bypass paths were found; both checks run unconditionally for any controller derived from `clsControllerBase`. | SAIF.Presentation.Web.MVC\clsControllerBase.vb |
| `NavigationContext` | `IsMenuItem(inApplication, inItem)` | Menu item / application code | Data lookup used as an authorization decision — resolves `inApplication` to an app code via `ApplicationCodes.ItemByAppPath`, then calls `MenuAuthorizedItems.FindPage(appCode, inItem)`; returns `True` only if a matching authorized menu entry exists for the current user. `MenuAuthorizedItems` (`clsMenuAuthorizedItemCollection`, defined in the external `SAIF.Business.Menu` library) is populated per-user at `NavigationContext` construction time via a DB call (`clsMenuAuthorizedItemCollection.GetMenuAuthorizedItems(m_DPI, inUser)`), so the "role" here is implicitly whatever menu items are provisioned for that user in the database — not an AD group. | SAIF.Presentation.Web.MVC\NavigationContext.vb |

No further programmatic authorization checks (role attributes, filter attributes, `OnAuthorization` overrides) were found in `ViewPageBase.aspx.vb`, `ViewControlBase.ascx.vb`, `clsModelBase.vb`, `clsContext.vb`, `clsOnlineContext.vb`, or `clsFactoryBase.vb` — those files only store/propagate the `clsSecurityPrincipal` reference and application/user context without performing access decisions themselves.

## Data-level authorization

| Entity type | Validation method | Mechanism | Source |
| --- | --- | --- | --- |
| Menu item / page (identified by application code + URL path segment) | `RedirectUnauthorizedUsers()` / `NavigationContext.IsMenuItem()` | Looks up the current user's pre-loaded `clsMenuAuthorizedItemCollection` (populated from the database at login via `clsMenuAuthorizedItemCollection.GetMenuAuthorizedItems`, an external `SAIF.Business.Menu` type) to confirm the requested page is one the user is entitled to see; redirects to the login page if not found. | SAIF.Presentation.Web.MVC\clsControllerBase.vb; SAIF.Presentation.Web.MVC\NavigationContext.vb |

This is page-existence authorization, not object-ownership authorization — it does not validate that a specific business entity (e.g., a policy or claim) belongs to the current user. No `CheckValidContext`, `IsValidPolicyForCurrentUser`, `ValidateOwnership`, or similar ownership-validation methods were found in this library.

## Segregation of duties

None found. No classes named `*SegregationOfDuties*`/`*SOD*`, no SQL/menu-structure conflict-checking queries, and no business rules restricting mutually exclusive permission combinations exist anywhere in this library.

## Security interfaces and contracts

| Interface / Class | Role | Consumers | Source |
| --- | --- | --- | --- |
| `clsSecurityPrincipal` | Opaque, already-authenticated identity/principal holder (`.IsAuthenticated`, `.UserName`); external type defined in `SAIF.BOF.Framework`, not defined or extended by this library. | `clsControllerBase.SecurityCheck`, `clsControllerBase.Navigate2`, `clsContext.SecurityPrincipal`, `clsOnlineContext` | SAIF.Presentation.Web.MVC\clsControllerBase.vb; SAIF.Presentation.Web.MVC\clsContext.vb; SAIF.Presentation.Web.MVC\clsOnlineContext.vb |

## Notes
- Verified: `SecurityCheck()`, `RedirectUnauthorizedUsers()`, `Initialize()` orchestration, and `NavigationContext.IsMenuItem()` behavior — all read directly from source in this library.
- The semantics of `clsMenuAuthorizedItemCollection`/`GetMenuAuthorizedItems` (that they represent a per-user, database-provisioned set of authorized menu/page entries) are inferred from usage in `NavigationContext.vb`*; the implementation itself lives in the external `SAIF.Business.Menu` library and was not re-analyzed as part of this library's security pass.
- Whether any WCF `SecurityService`/AD-group-based authorization is enforced elsewhere in the broader SAIF platform (e.g., at IIS/HttpModule level, or within `SAIF.Business.Menu`'s data layer) could not be confirmed from this library's source alone.**

## Related documentation
- [Index](index.md)
- [Overview](overview.md)
- [Architecture](architecture.md)
- [Dependencies](dependencies.md)
- [Operations and processes](operations-processes.md)
- [Business rules](business-rules.md)
- [Configuration](configuration.md)
- [Database tables](database-tables.md)
- [SQL catalog](sql/index.md)
- [API reference](api/index.md)

> **Note:** Statements marked with `*` were inferred from code structure, naming
> conventions, or contextual evidence where direct confirmation was not available
> in source artifacts. Statements marked with `**` could not be confirmed; treat
> as unknown until verified.

## Sources
- SAIF.Presentation.Web.MVC\clsControllerBase.vb
- SAIF.Presentation.Web.MVC\NavigationContext.vb
- SAIF.Presentation.Web.MVC\clsContext.vb
- SAIF.Presentation.Web.MVC\clsModelBase.vb
- SAIF.Presentation.Web.MVC\clsOnlineContext.vb
- SAIF.Presentation.Web.MVC\clsFactoryBase.vb
- SAIF.Presentation.Web.MVC\ViewPageBase.aspx.vb
- SAIF.Presentation.Web.MVC\ViewControlBase.ascx.vb