---
title: Legacy resource membership enumeration
summary: Enumerates which accounts currently have access to a legacy resource.
status: draft
owner: <owner>
last_reviewed: 2026-07-30
library: SAIF.Framework.Security
reference_type: package
operation_id: OP-007
trigger: Caller invokes `GetWhoHasAccess`
---

# Legacy resource membership enumeration

Rather than answering a yes/no authorization question, this operation returns the full list of accounts that currently have access to a legacy resource — useful for auditing or troubleshooting access issues. It goes through the same legacy ASMX AD service as the resource-access checks and applies the same non-production `Test` suffix convention.

| Field | Value |
| --- | --- |
| **Operation ID** | OP-007 |
| **Trigger** | Caller invokes `GetWhoHasAccess` |
| **Inputs** | Base resource name |
| **Outputs** | Member account array |
| **Primary components** | `clsAccountMaintProxy.GetWhoHasAccess`, `GetADService` |
| **Entry point** | `SAIF.Framework.Security\clsAccountMaintProxy.vb` |

## Steps

1. The method resolves a `clsADServices` proxy through `GetADService()`, reusing the same legacy endpoint-resolution logic as the other `clsAccountMaintProxy` operations.
2. In production, the method calls `WhoHasAccessCache(resourceName)` directly with the base resource name; in non-production, it first appends the plain `Test` suffix — enforcing the same [BR-002](../business-rules.md#br-002-legacy-asmx-resource-checks-use-a-plain-test-suffix) convention used by legacy access checks.
   - Authorization context: this operation is useful for authorization troubleshooting and visibility, but it is not itself listed as an enforcement point in [Authorization enforcement points](../security-authorization.md#authorization-enforcement-points) — it only reports membership, it does not decide access.
3. The array returned by the ASMX service is passed straight back to the caller with no local transformation.
   - On failure: any service exception propagates because the method does not catch it locally.

## Process flow

The following diagram visualizes this operation's control flow.

```mermaid
flowchart TD
	Start([Membership list requested]) --> Proxy[Create clsADServices proxy]
	Proxy --> Env{Production?}
	Env -->|Yes| CallProd[Call WhoHasAccessCache]
	Env -->|No| CallTest[Append Test and call]
	CallProd --> EndOk([Return member array])
	CallTest --> EndOk
```

## Failure and edge-case behavior

- Non-production requests use the legacy plain `Test` suffix, matching the convention used elsewhere in `clsAccountMaintProxy`.
- The method performs no filtering or transformation of the service response — callers receive the raw member array exactly as the ASMX service returned it.
- Service failures propagate unchanged to the caller.

## Related documentation
- [Operations and processes](../operations-processes.md)
- [Business rules](../business-rules.md)
- [Security and authorization](../security-authorization.md)

## Sources
- `SAIF.Framework.Security\clsAccountMaintProxy.vb`