Skip to content

MachineSecurityService

MachineSecurityService authorizes a machine/service account (as opposed to an interactive user) against an AD security group, for scenarios such as batch jobs or server-to-server calls authenticating with a computer account. It implements IMachineSecurityService.

Purpose

  • Validate whether a named machine/service account is a member of an AD security group by enumerating group membership via the WCF SecurityService and matching in-process.

Context

  • Namespace: SAIF.Framework.Security.Utilities
  • Assembly/package: SAIF.BOF.Framework.Security (bundled into the repository-wide SAIF.BOF.Framework NuGet package)

Public members

Member Signature Purpose
New Sub New(Optional ldap As String = "LDAP://slmdc01.corp.saif.com:389/DC=corp,DC=saif,DC=com", Optional domain As String = "saif", Optional recurse As Boolean = True) Constructs the service, resolving the WCF endpoint URL via a CustomEnvironmentService hard-coded to CustomEnvironment.Prod.
IsAuthorized Function IsAuthorized(machine As String, ByRef groupName As String, Optional isResource As Boolean = True, Optional useProductionSecurityResource As Boolean = True) As Boolean Implements IMachineSecurityService.IsAuthorized. Optionally suffixes groupName, calls SecurityService.SecurityClient.GetUsersByGroup, and matches machine case-insensitively against the returned members. See BR-003 and BR-008.
Dispose Sub Dispose() Implements IDisposable.Dispose. No unmanaged resources currently require disposal; retained to fulfill the IDisposable contract.

Behavioral notes

  • Fails closed: if the underlying GetUsersByGroup WCF call throws, the exception is logged via Debug.WriteLine only, and the method returns False (not-authorized). See BR-008.
  • Resolves its environment/config settings via a CustomEnvironmentService instance hard-coded to CustomEnvironment.Prod, distinct from the AppGlobal.EnvironmentService singleton used by clsSecurityPrincipal — the two classes also read the same logical config key (securityServiceUrl vs. securityserviceurl) under different casings.*
  • No SAMAccountName $-suffix stripping logic is present; the machine parameter is compared as-is against whatever strings GetUsersByGroup returns.**

Constraints and usage notes

  • Default LDAP root is LDAP://slmdc01.corp.saif.com:389/DC=corp,DC=saif,DC=com; default domain is saif; group-membership recursion defaults to True — all overridable via constructor parameters.
  • groupName is passed ByRef and mutated in place when isResource=True (the suffix is appended to the caller's variable).
  • Whether the WCF service itself normalizes a trailing $ on computer account names is unknown from this repository.**

Note: Statements marked with * were inferred from code structure, naming conventions, or contextual evidence where direct confirmation was not available in source artifacts. Statements marked with ** could not be confirmed; treat as unknown until verified.

Sources

  • SAIF.Framework.Security\Utilities\MachineSecurityService.vb