Tech debt

ActiveDirectoryServiceProxy has no exception handling at any call site, disposes a possibly faulted channel without an Abort() fallback, and its endpoint address cannot be traced to any caller inside this repository. Two of the twenty declared operations carry a password in the SOAP body over an unauthenticated, unencrypted binding.

CRITICAL

Finding	Component	Impact	Recommended action
The contract exposes GetPaymentPassword and SetPaymentPassword, which carry a password value in the SOAP body over a binding with BasicHttpSecurityMode.None	clsADServices.wsdl (contract); ActiveDirectoryServiceProxy.cs:19 (binding)	If any future caller invokes these operations, a password crosses the network unencrypted and unauthenticated	Do not call these operations without transport security; flag them for removal from the wrapper's surface if never needed

HIGH

Finding	Component	Impact	Recommended action
No exception handling at any of the four call sites	ActiveDirectoryServiceProxy.cs:28,34-35,40	FaultException / CommunicationException / TimeoutException propagate raw to whatever external consumer calls this wrapper	Decide and document an explicit failure contract
Dispose() calls Close() with no Abort() fallback	ActiveDirectoryServiceProxy.cs:75-83	A faulted channel throws CommunicationObjectFaultedException from Dispose, masking the original failure	Add an Abort() path for a faulted channel
No timeout, retry, or cancellation configured; the binding is new BasicHttpBinding() with framework defaults	ActiveDirectoryServiceProxy.cs:19	A hung remote call blocks the caller for the binding's default receive timeout (10 minutes)	Set explicit timeouts; add retry where appropriate
HasAccess returns the remote boolean directly, with no fail-safe default on failure	ActiveDirectoryServiceProxy.cs:31-36	Whether a consumer fails open or closed on an exception is unknown**	Document the intended behavior for consumers making authorization decisions
The two <client><endpoint> entries in app.config are dead configuration — the source builds its own binding and address in code	Services/SAIF.Services.Web.Proxies/app.config:52-53	A maintainer editing the config would have no effect on runtime behavior	Remove the unused endpoints or wire the wrapper to read them
serviceUrl's origin cannot be traced to any caller in this repository	ActiveDirectoryServiceProxy.cs:14-16	The runtime endpoint used by any real caller is unknown from this repository alone**	Confirm with the consuming application how the URL is supplied
No repository source constructs ActiveDirectoryServiceProxy	Repository-wide search	The wrapper, the proxy, and their business logic are compiled and shipped but unexercised inside this repository	Confirm whether an external consumer of SAIF.SAIFCode.Core actually uses this type

Related documentation

• Client index
• Overview
• Architecture
• Contract
• Operation map
• Client reference
• Consumption
• Dependencies

Note: Statements marked with ** could not be confirmed; treat as unknown until verified.

Sources

• Services/SAIF.Services.Web.Proxies/ActiveDirectoryServiceProxy.cs
• Services/SAIF.Services.Web.Proxies/app.config
• Services/SAIF.Services.Web.Proxies/Service References/ActiveDirectory/clsADServices.wsdl