Skip to content

Machine or service-account authorization

Unlike the human-identity checks above, this operation authorizes a machine or service account — typically from a batch job or infrastructure process rather than an interactive session. Because the WCF SecurityService has no direct "is this account authorized" call for machine accounts, the method instead retrieves the group's full membership list and searches it in-process for the requested machine name.

Field Value
Operation ID OP-005
Trigger Caller invokes MachineSecurityService.IsAuthorized
Inputs Machine name, mutable group name, resource flags, constructor LDAP and domain settings
Outputs Boolean authorization decision and possibly mutated groupName
Primary components MachineSecurityService.New, MachineSecurityService.IsAuthorized
Entry point SAIF.Framework.Security\Utilities\MachineSecurityService.vb

Steps

  1. The constructor captures the LDAP path, domain, and recurse settings it will need for every lookup, and resolves securityServiceUrl from CustomEnvironmentService once, up front, so each authorization call has a ready-made WCF endpoint.
  2. When isResource=True, the method mutates groupName in place: it appends Test for any non-production-resource lookup and then always appends Resource, enforcing BR-003.
  3. Authorization context: the resulting group name follows the naming convention documented in the AD resource catalog.
  4. The method constructs SecurityService.SecurityClient(_serviceUrl) and calls GetUsersByGroup(groupName, _ldap, _domain, _recurse) to pull back the group's effective member list — this is the only WCF call the operation makes.
  5. Authorization context: this is the machine-account enforcement path listed in Authorization enforcement points.
  6. The returned member names are scanned case-insensitively, and the method returns True as soon as it finds an exact match for the requested machine name.
  7. If no match is found: the method falls through to the default False result rather than treating an empty match as an error.
  8. Any exception raised while calling the WCF service is written to Debug and swallowed; the method then returns False, enforcing BR-008 so a downed or unreachable security service can never be mistaken for an authorized outcome.

Process flow

The following diagram visualizes this operation's control flow.

flowchart TD
    Start([Machine auth requested]) --> Name[Apply resource suffix rules]
    Name --> Call[GetUsersByGroup]
    Call --> Error{Call succeeded?}
    Error -->|No| FailClosed[Return False]
    Error -->|Yes| Match{Machine found?}
    Match -->|Yes| EndOk([Return True])
    Match -->|No| EndErr([Return False])
    FailClosed --> EndErr

Failure and edge-case behavior

  • groupName is a byref parameter and is mutated in place whenever resource suffixing is enabled, so callers see the effective (suffixed) group name after the call returns.
  • WCF failures are swallowed at the Debug log level and converted into a fail-closed False result rather than being surfaced to the caller.
  • Membership matching is case-insensitive but otherwise requires an exact match against the returned member string.

Sources

  • SAIF.Framework.Security\Utilities\MachineSecurityService.vb