--- title: SAIF.Framework.Security dependencies summary: Internal and external dependencies for the SAIF.Framework.Security library, including the mixed WCF SecurityService and legacy ASMX clsADServices integration paths. status: draft owner: last_reviewed: 2026-07-23 library: SAIF.Framework.Security reference_type: package --- # SAIF.Framework.Security dependencies ## Internal dependencies | Dependency | Type | Usage | | --- | --- | --- | | SAIF.Framework.Security.EnvironmentApi | Internal | Referenced via `` in `SAIF.BOF.Framework.Security.vbproj`. Supplies `EnvironmentServiceBase`, `WebEnvironmentService`, `WindowsEnvironmentService`, `CustomEnvironmentService`, `ApplicationEnvironment`, and `IEnvironmentService.GetConfigSetting`, consumed throughout this library (e.g., `AppGlobal.vb`, `Utilities\MachineSecurityService.vb:18`). See [Configuration](configuration.md) for the concrete Environment API keys and transitive EnvironmentApi requirements this library relies on. | ## External dependencies | Dependency | Version | Usage | | --- | --- | --- | | WCF `SecurityService` (Service Reference) | N/A (WSDL-generated proxy) | Primary/modern authorization and user-lookup endpoint. Client class `SecurityService.SecurityClient`, generated from `Service References\SecurityService\Reference.vb`, `SecurityService.wsdl`, and `Security*.xsd`. Configured endpoint address `http://saifonline/WCF/Security` via `basicHttpBinding` (`app.config:45,55`); URL also resolved at runtime from the `securityserviceurl`/`securityServiceUrl` config key. Called by `clsSecurityPrincipal.IsAuthorizedSecurityService` (`IsAuthorized`) and `Utilities.MachineSecurityService.IsAuthorized` (`GetUsersByGroup`). | | Legacy ASMX `clsADServices` (Web Reference) | N/A (WSDL-generated proxy) | Legacy AD web service retained for backward compatibility during migration. Generated from `Web References\ADServices\Reference.vb`, `clsadservices.wsdl`, `clsadservices.disco`. Exposes `HasAccess`, `HasAccessExternal`, `HasAccessCache`, `HasAccessCacheExternal`, `WhoHasAccessCache`, `GetUserInfo`, `GetUserInfoExternal`, `GetEMailAddress`, `GetIDNumber`, `GetLastLogon`, and payment-password/menu-cache methods. Called by `clsAccountMaintProxy` and by `clsSecurityPrincipal.GetEmailAddress`/`GetIDNumber`/`GetDefaultPrinter`. URL resolved from the `legacyADServiceUrl` config key. | | `System.DirectoryServices` | Framework-standard (BCL) | Imported in `clsSecurityPrincipal.vb`; namespace imported only, no direct `DirectoryEntry`/`DirectorySearcher` usage found in live code.* | | `System.Security.Principal` | Framework-standard (BCL) | `WindowsIdentity`, `WindowsPrincipal`, `GenericPrincipal` used for identity capture. | | `System.ServiceModel` / `System.ServiceModel.Description` | Framework-standard (BCL) | WCF client construction for the `SecurityService` path. | | `System.Web` / `System.Web.Security` | Framework-standard (BCL) | `FormsAuthentication`, `HttpContext`, `HttpCookie` used for Forms-identity initialization and login cookie handling. | | `System.Runtime.InteropServices` | Framework-standard (BCL) | P/Invoke declarations (`advapi32.dll`, `Kernel32.dll`, `crypt32.dll`) for impersonation and DPAPI. | | `System.Security.Cryptography` / `System.Security.Cryptography.X509Certificates` | Framework-standard (BCL) | AES, MD5, and X.509 certificate operations in `Cryptography\`. | | `System.EnterpriseServices` / `System.Runtime.Serialization` | Framework-standard (BCL) | Referenced assemblies; no direct usage observed in scanned files.** | | `Newtonsoft.Json` | N/A | Declared via `` in the project file; no direct JSON serialization call found in live code scanned.** | ## API dependencies | Endpoint | Method | Called from | Purpose | | --- | --- | --- | --- | | WCF `SecurityService` (`http://saifonline/WCF/Security`) | `IsAuthorized` | `clsSecurityPrincipal.IsAuthorizedSecurityService` | Resource/role authorization decision for the current principal. | | WCF `SecurityService` (`http://saifonline/WCF/Security`) | `GetUsersByGroup` | `Utilities.MachineSecurityService.IsAuthorized` | Enumerate AD group membership for in-process machine-account matching. | | WCF `SecurityService` (`http://saifonline/WCF/Security`) | `IsAuthorized2`, `GetUser`, `GetSaifUserByUserId`, `GetUserIdForEmployeeId`, `GetSaifUserByEmployeeId`, `GetExternalUser`, `GetInjuredWorkerUserByCustomerId`, `GetExternalUserByCustomerId` | Declared on the contract; not invoked from this library's own code (available for consuming applications).* | User-lookup and dual-domain authorization operations. | | Legacy `clsADServices.asmx` | `HasAccess` / `HasAccessExternal` | `clsAccountMaintProxy.ResourceAccessValid`/`ResourceAccessValidExternal` | Legacy resource-access authorization check (internal/external domain). | | Legacy `clsADServices.asmx` | `HasAccessCache` / `HasAccessCacheExternal` | `clsAccountMaintProxy.ResourceAccessValidCached`/`ResourceAccessValidCachedExternal` | Legacy cached resource-access authorization check. | | Legacy `clsADServices.asmx` | `WhoHasAccessCache` | `clsAccountMaintProxy.GetWhoHasAccess` | Enumerate members with access to a resource. | | Legacy `clsADServices.asmx` | `GetEMailAddress` / `GetIDNumber` / menu-cache methods | `clsSecurityPrincipal.GetEmailAddress`/`GetIDNumber`/`GetDefaultPrinter` | Legacy directory attribute lookups. | ## Dependency risks and notes - **In-progress migration, dual endpoints**: The library maintains two parallel external authorization integrations — the modern WCF `SecurityService` and the legacy ASMX `clsADServices` — with no single path fully retired. `IsAuthorized`/`IsInRole`/`MachineSecurityService` use the WCF endpoint, while `clsAccountMaintProxy` and select `clsSecurityPrincipal` methods (`GetEmailAddress`, `GetIDNumber`, `GetDefaultPrinter`) still depend on the legacy ASMX endpoint.* Consumers must be aware which path a given method uses, since the two are not interchangeable. - **Inconsistent environment-suffix conventions across paths**: The WCF path appends `Resource`/`TestResource` to resource/role names, while the legacy ASMX path (`clsAccountMaintProxy`) appends only a plain `Test` suffix — same environment-isolation intent, different naming format, creating a risk of misconfiguration if a resource is provisioned under one convention but queried under the other. - **Inconsistent config-key casing/resolution for the same WCF endpoint**: `clsSecurityPrincipal` reads `securityserviceurl` via the `AppGlobal.EnvironmentService` singleton, while `Utilities.MachineSecurityService` reads `securityServiceUrl` via its own `CustomEnvironmentService` instance hard-coded to `CustomEnvironment.Prod` — this is the same logical setting resolved by two different code paths with different casing and different environment awareness. Whether the underlying config-key lookup is case-insensitive is not verified from this library's source.** - **Fail-closed behavior differs by design, not enforced consistently**: `Utilities.MachineSecurityService.IsAuthorized` swallows exceptions from the WCF call (`Debug.WriteLine` only) and falls through to a not-authorized result, which is a safe fail-closed behavior but is not something documented or guaranteed for the other authorization entry points (`clsSecurityPrincipal.IsAuthorized`/`IsInRole`). - **No static AD resource/group catalog**: All resource, role, and group names are caller-supplied strings; this library ships no fixed policy data, so any resource-naming risk (e.g., typos, suffix mismatches) originates in consuming applications, not here. - **Machine account `$`-suffix normalization is unverified**: No trailing `$` stripping logic (typical for `SAMAccountName` computer accounts) exists in `Utilities.MachineSecurityService`; whether the WCF service normalizes this server-side is unknown from this repository.** - **Declared but unused dependencies**: `System.EnterpriseServices`, `System.Runtime.Serialization`, and `Newtonsoft.Json` are referenced in the project file but show no direct usage in the scanned live code, representing potential dead weight in the dependency footprint.** ## Related documentation - [Index](index.md) - [Overview](overview.md) - [Architecture](architecture.md) - [Operations and processes](operations-processes.md) - [Business rules](business-rules.md) - [Configuration](configuration.md) - [Security and authorization](security-authorization.md) - [API reference](api/index.md) > **Note:** Statements marked with * were inferred from code structure, naming conventions, or > contextual evidence where direct confirmation was not available in source artifacts. Statements > marked with ** could not be confirmed; treat as unknown until verified. ## Sources - `SAIF.Framework.Security\SAIF.BOF.Framework.Security.vbproj` - `SAIF.Framework.Security\clsSecurityPrincipal.vb` - `SAIF.Framework.Security\clsAccountMaintProxy.vb` - `SAIF.Framework.Security\AppGlobal.vb` - `SAIF.Framework.Security\Utilities\MachineSecurityService.vb` - `SAIF.Framework.Security\Utilities\IMachineSecurityService.vb` - `SAIF.Framework.Security\Service References\SecurityService\Reference.vb` - `SAIF.Framework.Security\Web References\ADServices\Reference.vb` - `SAIF.Framework.Security\app.config`