SAIF.Presentation.Web.MVC security and authorization

This page documents authorization mechanisms implemented or consumed by this library. This library consumes clsSecurityPrincipal (an external type from SAIF.BOF.Framework) for authentication-state checks and performs challenge/deny handling based on its .IsAuthenticated result; it does not itself implement an authentication mechanism. The upstream authentication implementation that populates clsSecurityPrincipal (commonly infrastructure-level NTLM/AD in SAIF deployments) is not established by this library's source and is marked as unknown below.**

Authorization architecture

Authorization in this library is local/programmatic only — there is no centralized WCF SecurityService call, no [SAIFAuthorize]/[SaifAuthorize] attribute usage, and no direct AD/PrincipalContext/DirectoryEntry code anywhere in this library. Two independent, coarse-grained programmatic checks run unconditionally on every request from clsControllerBase.Initialize(): (1) SecurityCheck() verifies an authenticated principal is present, and (2) RedirectUnauthorizedUsers() gates page access using a database-provisioned, per-user menu entitlement lookup (NavigationContext.IsMenuItem) rather than named AD resource groups.

flowchart TD
    Browser[Browser request] --> Init[clsControllerBase.Initialize]
    Init --> SecCheck[SecurityCheck]
    SecCheck -->|No principal, clsEnvironment.InternalAddress true| Challenge[HTTP 401 NTLM/Basic challenge]
    SecCheck -->|No principal, clsEnvironment.InternalAddress false| Deny[Throw Not Authorized]
    SecCheck -->|Authenticated| NavBuild[Build/reuse NavigationContext in Session navdata]
    NavBuild --> MenuLookup[NavigationContext.IsMenuItem]
    MenuLookup -->|Not authorized| Redirect[Clear navdata, redirect to OnlineLogin/LoginScreen.aspx]
    MenuLookup -->|Authorized| Continue[Continue request pipeline]
    NavBuild --> MenuDB[(SAIF.Business.Menu data<br>Oracle, via clsMSOracleDataLayer)]

AD resource catalog

No AD group ("Resource") names, LDAP filters, or IsAuthorized(resourceName, env)-style calls are referenced anywhere in this library's own source. clsSecurityPrincipal is consumed only as an opaque, already-authenticated identity/principal holder (.IsAuthenticated, .UserName) — it is an external framework type defined in SAIF.BOF.Framework, and no resource-name string literals are passed to it from this library.

Resource name	Purpose	Enforcement point	Source
(none found)	—	—	—

Page-level access is instead governed by database-driven menu authorization data (see the "Programmatic authorization checks" and "Data-level authorization" sections below) rather than named AD resources referenced directly in this library's code.

Authorization enforcement points

Attribute-based authorization

None found. No AuthorizeAttribute-derived custom attributes, [SaifAuthorize]/<SAIFAuthorize> decorations, or AuthorizeCore overrides exist in this library.

Programmatic authorization checks

Class	Method	Resource / Role	Check type	Source
clsControllerBase	SecurityCheck()	None (no resource/role parameter)	Presence/authentication check — verifies Model.Context.SecurityPrincipal is populated; constructs a clsSecurityPrincipal(Platform.Web) and checks .IsAuthenticated. If authenticated, caches the principal on context and sets an STYPE cookie to the username. If not authenticated: callers for which the external clsEnvironment.InternalAddress(Request.UserHostAddress) check (a SAIF.BOF.Framework dependency, distinct from the local IsInsideClient property behind BR-MVC-008) returns True receive an HTTP 401 with WWW-Authenticate: NTLM/Basic challenge headers and the response ends; otherwise an Exception("Not Authorized.") is thrown.	SAIF.Presentation.Web.MVC\clsControllerBase.vb
clsControllerBase	RedirectUnauthorizedUsers()	Menu item, keyed by (currentApp, currentItem) derived from the request URL path	Menu-driven, data-backed page authorization (redirect-on-deny) — retrieves the per-user NavigationContext cached in Session("navdata") and calls navData.IsMenuItem(currentApp, currentItem). If the page is not found in the user's authorized menu set, the session's cached nav data is cleared and the request is redirected to /OnlineLogin/LoginScreen.aspx; a warning is traced. This is enforced by BR-MVC-002 and acts as the page/URL-level authorization gate for the whole request pipeline.	SAIF.Presentation.Web.MVC\clsControllerBase.vb
clsControllerBase	Initialize()	N/A (orchestration)	Orchestrates the two checks above on every request, in order: session-timeout redirect (BR-MVC-001) → SecurityCheck() → (lazily build/cache NavigationContext for the user in Session("navdata") if absent) → RedirectUnauthorizedUsers(). No bypass paths were found; both checks run unconditionally for any controller derived from clsControllerBase.	SAIF.Presentation.Web.MVC\clsControllerBase.vb
NavigationContext	IsMenuItem(inApplication, inItem)	Menu item / application code	Data lookup used as an authorization decision — resolves inApplication to an app code via ApplicationCodes.ItemByAppPath, then calls MenuAuthorizedItems.FindPage(appCode, inItem); returns True only if a matching authorized menu entry exists for the current user. MenuAuthorizedItems (clsMenuAuthorizedItemCollection, defined in the external SAIF.Business.Menu library) is populated per-user at NavigationContext construction time via a DB call (clsMenuAuthorizedItemCollection.GetMenuAuthorizedItems(m_DPI, inUser)), so the "role" here is implicitly whatever menu items are provisioned for that user in the database — not an AD group.	SAIF.Presentation.Web.MVC\NavigationContext.vb

No further programmatic authorization checks (role attributes, filter attributes, OnAuthorization overrides) were found in ViewPageBase.aspx.vb, ViewControlBase.ascx.vb, clsModelBase.vb, clsContext.vb, clsOnlineContext.vb, or clsFactoryBase.vb — those files only store/propagate the clsSecurityPrincipal reference and application/user context without performing access decisions themselves.

Data-level authorization

Entity type	Validation method	Mechanism	Source
Menu item / page (identified by application code + URL path segment)	RedirectUnauthorizedUsers() / NavigationContext.IsMenuItem()	Looks up the current user's pre-loaded clsMenuAuthorizedItemCollection (populated from the database at login via clsMenuAuthorizedItemCollection.GetMenuAuthorizedItems, an external SAIF.Business.Menu type) to confirm the requested page is one the user is entitled to see; redirects to the login page if not found.	SAIF.Presentation.Web.MVC\clsControllerBase.vb; SAIF.Presentation.Web.MVC\NavigationContext.vb

This is page-existence authorization, not object-ownership authorization — it does not validate that a specific business entity (e.g., a policy or claim) belongs to the current user. No CheckValidContext, IsValidPolicyForCurrentUser, ValidateOwnership, or similar ownership-validation methods were found in this library.

Segregation of duties

None found. No classes named *SegregationOfDuties*/*SOD*, no SQL/menu-structure conflict-checking queries, and no business rules restricting mutually exclusive permission combinations exist anywhere in this library.

Security interfaces and contracts

Interface / Class	Role	Consumers	Source
clsSecurityPrincipal	Opaque, already-authenticated identity/principal holder (.IsAuthenticated, .UserName); external type defined in SAIF.BOF.Framework, not defined or extended by this library.	clsControllerBase.SecurityCheck, clsControllerBase.Navigate2, clsContext.SecurityPrincipal, clsOnlineContext	SAIF.Presentation.Web.MVC\clsControllerBase.vb; SAIF.Presentation.Web.MVC\clsContext.vb; SAIF.Presentation.Web.MVC\clsOnlineContext.vb

Notes

• Verified: SecurityCheck(), RedirectUnauthorizedUsers(), Initialize() orchestration, and NavigationContext.IsMenuItem() behavior — all read directly from source in this library.
• The semantics of clsMenuAuthorizedItemCollection/GetMenuAuthorizedItems (that they represent a per-user, database-provisioned set of authorized menu/page entries) are inferred from usage in NavigationContext.vb*; the implementation itself lives in the external SAIF.Business.Menu library and was not re-analyzed as part of this library's security pass.
• Whether any WCF SecurityService/AD-group-based authorization is enforced elsewhere in the broader SAIF platform (e.g., at IIS/HttpModule level, or within SAIF.Business.Menu's data layer) could not be confirmed from this library's source alone.**

Related documentation

• Index
• Overview
• Architecture
• Dependencies
• Operations and processes
• Business rules
• Configuration
• Database tables
• SQL catalog
• API reference

Note: Statements marked with * were inferred from code structure, naming conventions, or contextual evidence where direct confirmation was not available in source artifacts. Statements marked with ** could not be confirmed; treat as unknown until verified.

Sources

• SAIF.Presentation.Web.MVC\clsControllerBase.vb
• SAIF.Presentation.Web.MVC\NavigationContext.vb
• SAIF.Presentation.Web.MVC\clsContext.vb
• SAIF.Presentation.Web.MVC\clsModelBase.vb
• SAIF.Presentation.Web.MVC\clsOnlineContext.vb
• SAIF.Presentation.Web.MVC\clsFactoryBase.vb
• SAIF.Presentation.Web.MVC\ViewPageBase.aspx.vb
• SAIF.Presentation.Web.MVC\ViewControlBase.ascx.vb