---
title: Query SecurityService group membership
summary: Forward a group-membership lookup to the centralized WCF service.
status: draft
owner: SAIF Framework
last_reviewed: 2026-07-30
library: SAIF.Framework.Security.EnvironmentApi
reference_type: package
operation_id: OP-ENV-009
trigger: Caller invokes SecurityServiceClient.GetUsersByGroup
---

# Query SecurityService group membership

This operation gives downstream consumers a server-side alternative to local LDAP traversal: instead of querying Active Directory directly, it forwards the membership request to the centralized `SecurityService` over WCF. It opens a short-lived client channel for each call, forwards the request, and returns whatever the remote service reports.

| Field | Value |
| --- | --- |
| **Operation ID** | OP-ENV-009 |
| **Trigger** | Caller chooses the WCF-based membership lookup path |
| **Inputs** | `groupName`, optional `ldap`, optional `domain`, optional `recurse` |
| **Outputs** | Remote `string[]` membership result |
| **Primary components** | `SecurityServiceClient.GetUsersByGroup`, `SecurityService.SecurityClient.GetUsersByGroup` |
| **Entry point** | `SAIF.Framework.Security.EnvironmentApi\Core\Services\SecurityServiceClient.cs` |

## Steps

1. Create a `BasicHttpBinding` and `EndpointAddress` from the service URL supplied to the `SecurityServiceClient` constructor.
2. Open a generated `SecurityService.SecurityClient` channel inside a `using` block so the connection is always released.
3. Invoke `security.GetUsersByGroup(groupName, ldap, domain, recurse: false)` against the remote endpoint.
4. Return the service's result to the caller unchanged.
5. Dispose the generated client when the `using` block exits.

## Process flow

The following diagram visualizes this operation's control flow.

```mermaid
flowchart TD
	Start([Caller requests WCF membership lookup]) --> Binding[Create binding and endpoint]
	Binding --> Client[Open SecurityClient]
	Client --> Call[Invoke GetUsersByGroup]
	Call --> Dispose[Dispose WCF client]
	Dispose --> End([Return remote member array])
```

## Failure and edge-case behavior

- The forwarded service call always uses `recurse: false`, regardless of the value the caller passed in — a caller requesting recursive membership through this path will silently get non-recursive results.
- Transport and service exceptions are not handled locally and reach the caller as-is.
- This wrapper does not reconcile its results with the library's local LDAP traversal path in [Enumerate AD group membership](enumerate-ad-group-membership.md); the two paths can diverge if the WCF service and local AD lookup are configured against different domains or scopes.

## Related documentation
- [Operations and processes](../operations-processes.md)
- [Business rules](../business-rules.md)
- [Security and authorization](../security-authorization.md)
- [Dependencies](../dependencies.md)

## Sources
- SAIF.Framework.Security.EnvironmentApi\Core\Services\SecurityServiceClient.cs
- SAIF.Framework.Security.EnvironmentApi\Connected Services\SecurityService\Reference.cs
- SAIF.Framework.Security.EnvironmentApi\app.config