---
title: Machine or service-account authorization
summary: Validates a machine or service account against an AD group by enumerating WCF group membership.
status: draft
owner: <owner>
last_reviewed: 2026-07-30
library: SAIF.Framework.Security
reference_type: package
operation_id: OP-005
trigger: Caller invokes `MachineSecurityService.IsAuthorized`
---

# Machine or service-account authorization

Unlike the human-identity checks above, this operation authorizes a machine or service account — typically from a batch job or infrastructure process rather than an interactive session. Because the WCF `SecurityService` has no direct "is this account authorized" call for machine accounts, the method instead retrieves the group's full membership list and searches it in-process for the requested machine name.

| Field | Value |
| --- | --- |
| **Operation ID** | OP-005 |
| **Trigger** | Caller invokes `MachineSecurityService.IsAuthorized` |
| **Inputs** | Machine name, mutable group name, resource flags, constructor LDAP and domain settings |
| **Outputs** | Boolean authorization decision and possibly mutated `groupName` |
| **Primary components** | `MachineSecurityService.New`, `MachineSecurityService.IsAuthorized` |
| **Entry point** | `SAIF.Framework.Security\Utilities\MachineSecurityService.vb` |

## Steps

1. The constructor captures the LDAP path, domain, and recurse settings it will need for every lookup, and resolves `securityServiceUrl` from `CustomEnvironmentService` once, up front, so each authorization call has a ready-made WCF endpoint.
2. When `isResource=True`, the method mutates `groupName` in place: it appends `Test` for any non-production-resource lookup and then always appends `Resource`, enforcing [BR-003](../business-rules.md#br-003-machine-security-group-names-use-testresource-suffixing).
   - Authorization context: the resulting group name follows the naming convention documented in the [AD resource catalog](../security-authorization.md#ad-resource-catalog).
3. The method constructs `SecurityService.SecurityClient(_serviceUrl)` and calls `GetUsersByGroup(groupName, _ldap, _domain, _recurse)` to pull back the group's effective member list — this is the only WCF call the operation makes.
   - Authorization context: this is the machine-account enforcement path listed in [Authorization enforcement points](../security-authorization.md#authorization-enforcement-points).
4. The returned member names are scanned case-insensitively, and the method returns `True` as soon as it finds an exact match for the requested machine name.
   - If no match is found: the method falls through to the default `False` result rather than treating an empty match as an error.
5. Any exception raised while calling the WCF service is written to `Debug` and swallowed; the method then returns `False`, enforcing [BR-008](../business-rules.md#br-008-machine-authorization-fails-closed-on-service-error) so a downed or unreachable security service can never be mistaken for an authorized outcome.

## Process flow

The following diagram visualizes this operation's control flow.

```mermaid
flowchart TD
	Start([Machine auth requested]) --> Name[Apply resource suffix rules]
	Name --> Call[GetUsersByGroup]
	Call --> Error{Call succeeded?}
	Error -->|No| FailClosed[Return False]
	Error -->|Yes| Match{Machine found?}
	Match -->|Yes| EndOk([Return True])
	Match -->|No| EndErr([Return False])
	FailClosed --> EndErr
```

## Failure and edge-case behavior

- `groupName` is a byref parameter and is mutated in place whenever resource suffixing is enabled, so callers see the effective (suffixed) group name after the call returns.
- WCF failures are swallowed at the `Debug` log level and converted into a fail-closed `False` result rather than being surfaced to the caller.
- Membership matching is case-insensitive but otherwise requires an exact match against the returned member string.

## Related documentation
- [Operations and processes](../operations-processes.md)
- [Business rules](../business-rules.md)
- [Security and authorization](../security-authorization.md)

## Sources
- `SAIF.Framework.Security\Utilities\MachineSecurityService.vb`