Skip to content

SAIF.Framework.Security overview

Documentation context: Packaged Component (NuGet)

This library's source is bundled into the repository-wide SAIF.BOF.Framework NuGet package via the SAIF.Framework.Core\SAIF.BOF.Framework.Core.nuspec wildcard <file> glob (..\**\*.vb;..\**\*.cs), independent of any <ProjectReference> chain.*

SAIF.Framework.Security is the framework-level security primitives library for SAIF BOF applications. It provides identity capture/impersonation, delegates resource and role authorization decisions to a centralized WCF SecurityService, retains a legacy ASMX clsADServices integration path for backward compatibility, and offers general-purpose cryptography helpers used by login and credential flows.

Purpose

  • Provide the mechanisms consuming applications use to capture the current Windows/Forms identity, authenticate via NTLM, and impersonate the resulting principal.
  • Delegate resource/role authorization decisions to a centralized WCF SecurityService, while retaining a legacy ASMX clsADServices path for account lookups and resource-access checks not yet migrated.
  • Authorize machine/service accounts against AD security groups for batch/server-to-server scenarios.
  • Supply standalone cryptography helpers (DPAPI, AES, MD5, X.509) consumed by login/credential flows.
  • Expose a COM-visible authorization wrapper for legacy, non-.NET Windows clients.

Responsibilities

  • Identity capture and impersonation for Web (Forms/Windows) and Windows-application platforms.
  • Programmatic resource and role authorization dispatch to the WCF SecurityService.
  • Legacy resource-access checks and directory lookups via the ASMX clsADServices proxy.
  • Machine/service-account AD group-membership authorization.
  • Environment/configuration resolution shared across both integration paths.
  • Cryptography utilities (DPAPI, AES, MD5, X.509 certificate operations).
  • Login orchestration, including encrypted "automated login" credential round-trips.

Key components

  • clsSecurityPrincipal: Core security principal — identity capture, NTLM authentication, and WCF SecurityService authorization dispatch.
  • clsSecurityPrincipalCOM: COM-visible wrapper delegating to clsSecurityPrincipal.
  • clsAccountMaintProxy: Legacy ASMX clsADServices account/resource-access proxy.
  • Utilities.MachineSecurityService (IMachineSecurityService): Machine/service-account AD group authorization.
  • clsElevateImpersonate / SAIFCredentials: Win32 impersonation for explicit-credential scenarios.
  • clsSAIFLoginInfo: Login orchestration and encrypted automated-login cookie management.
  • AppGlobal: Environment/config resolution boundary.
  • Cryptography\ (AES, Certificates, MD5Hash) and DAPIEncrypt.vb (DPAPI): Standalone cryptography utilities.

Note: Statements marked with * were inferred from code structure, naming conventions, or contextual evidence where direct confirmation was not available in source artifacts.

Sources

  • SAIF.Framework.Security\SAIF.BOF.Framework.Security.vbproj
  • SAIF.Framework.Security\clsSecurityPrincipal.vb
  • SAIF.Framework.Security\clsAccountMaintProxy.vb
  • SAIF.Framework.Security\Utilities\MachineSecurityService.vb
  • SAIF.Framework.Core\SAIF.BOF.Framework.Core.nuspec