---
title: SecurityServiceClient
summary: API reference for SecurityServiceClient.
status: draft
owner: <owner>
last_reviewed: 2026-07-23
library: SAIF.Framework.Security.EnvironmentApi
reference_type: package
---

# SecurityServiceClient

`SecurityServiceClient` is a thin WCF client wrapper around the generated `SecurityService.SecurityClient` proxy. It exposes `GetUsersByGroup` as a server-side alternative to the local `ADService`/`MachineSecurityService` AD-lookup path, intended for use by downstream consumers of this library rather than used internally.

## Purpose
- Provide a simplified, disposable client for calling the centralized `SecurityService` WCF endpoint's `GetUsersByGroup` operation.

## Context
- Namespace: `ClientProxies`
- Assembly/package: `SAIF.Framework.Security.EnvironmentApi`

## Public members
| Member | Signature | Purpose |
| --- | --- | --- |
| LDAP | `public const string LDAP = "LDAP://slmdc01.corp.saif.com:389/DC=corp,DC=saif,DC=com"` | Default LDAP path used when a caller does not supply one to `GetUsersByGroup`. |
| DOMAIN | `public const string DOMAIN = "saif"` | Default domain name used when a caller does not supply one to `GetUsersByGroup`. |
| SecurityServiceClient(serviceUrl) | `public SecurityServiceClient(string serviceUrl)` | Constructs the client bound to a caller-supplied `SecurityService` endpoint URL. |
| GetUsersByGroup | `public string[] GetUsersByGroup(string groupName, string ldap = LDAP, string domain = DOMAIN, bool recurse = false)` | Opens a `BasicHttpBinding`/`EndpointAddress` WCF channel per call and forwards the group-membership request to the `SecurityService` endpoint's `GetUsersByGroup` operation. |
| Dispose | `public void Dispose()` | No-op; retained to fulfill the `IDisposable` contract. |

## Behavioral notes
- The `serviceUrl` constructor argument is supplied externally by the caller; it is not read internally from `EnvironmentConfigKeys.SecurityServiceUrl`*.
- Each call to `GetUsersByGroup` opens and disposes a new WCF channel (`using` block) rather than reusing a long-lived client connection.
- The underlying generated proxy call always passes `recurse: false` regardless of the `recurse` parameter's value — the `recurse` parameter is accepted but not forwarded to the remote call**.
- No call site invoking this class was found elsewhere within this library — it appears to be provided for use by downstream consumers of this API library rather than used internally*.

## Constraints and usage notes
- Requires the `SecurityService` WCF endpoint (configured at `http://saifonline/WCF/Security`, binding `BasicHttpBinding_Security`) to be reachable at the supplied `serviceUrl`.
- Represents an equivalent, but not reconciled, alternative to the local `ADService`/`MachineSecurityService` authorization path — see [security-authorization.md](../../security-authorization.md).

> **Note:** Statements marked with * were inferred from code structure, naming conventions, or
> contextual evidence where direct confirmation was not available in source artifacts. Statements
> marked with ** could not be confirmed; treat as unknown until verified.

## Sources
- SAIF.Framework.Security.EnvironmentApi\Core\Services\SecurityServiceClient.cs
- SAIF.Framework.Security.EnvironmentApi\Connected Services\SecurityService\Reference.cs
- SAIF.Framework.Security.EnvironmentApi\app.config