Skip to content

Query SecurityService group membership

This operation gives downstream consumers a server-side alternative to local LDAP traversal: instead of querying Active Directory directly, it forwards the membership request to the centralized SecurityService over WCF. It opens a short-lived client channel for each call, forwards the request, and returns whatever the remote service reports.

Field Value
Operation ID OP-ENV-009
Trigger Caller chooses the WCF-based membership lookup path
Inputs groupName, optional ldap, optional domain, optional recurse
Outputs Remote string[] membership result
Primary components SecurityServiceClient.GetUsersByGroup, SecurityService.SecurityClient.GetUsersByGroup
Entry point SAIF.Framework.Security.EnvironmentApi\Core\Services\SecurityServiceClient.cs

Steps

  1. Create a BasicHttpBinding and EndpointAddress from the service URL supplied to the SecurityServiceClient constructor.
  2. Open a generated SecurityService.SecurityClient channel inside a using block so the connection is always released.
  3. Invoke security.GetUsersByGroup(groupName, ldap, domain, recurse: false) against the remote endpoint.
  4. Return the service's result to the caller unchanged.
  5. Dispose the generated client when the using block exits.

Process flow

The following diagram visualizes this operation's control flow.

flowchart TD
    Start([Caller requests WCF membership lookup]) --> Binding[Create binding and endpoint]
    Binding --> Client[Open SecurityClient]
    Client --> Call[Invoke GetUsersByGroup]
    Call --> Dispose[Dispose WCF client]
    Dispose --> End([Return remote member array])

Failure and edge-case behavior

  • The forwarded service call always uses recurse: false, regardless of the value the caller passed in — a caller requesting recursive membership through this path will silently get non-recursive results.
  • Transport and service exceptions are not handled locally and reach the caller as-is.
  • This wrapper does not reconcile its results with the library's local LDAP traversal path in Enumerate AD group membership; the two paths can diverge if the WCF service and local AD lookup are configured against different domains or scopes.

Sources

  • SAIF.Framework.Security.EnvironmentApi\Core\Services\SecurityServiceClient.cs
  • SAIF.Framework.Security.EnvironmentApi\Connected Services\SecurityService\Reference.cs
  • SAIF.Framework.Security.EnvironmentApi\app.config