---
title: SAIF.Framework.Security security and authorization
summary: Authorization requirements, AD resource groups, security enforcement points, and data-level access control for SAIF.Framework.Security.
status: draft
owner: <owner>
last_reviewed: 2026-07-23
library: SAIF.Framework.Security
reference_type: package
---

# SAIF.Framework.Security security and authorization

This page documents authorization mechanisms implemented or consumed by this library. Authentication is handled entirely by infrastructure (NTLM/AD) and is not application-level for consuming applications; however, because this library *is* the framework's identity/authentication primitives layer rather than a consuming application, its authentication-adjacent mechanisms (`Authenticate()`, `InitWindowsIdentity`/`InitFormsIdentity`, impersonation) are noted here for completeness even though authentication itself is out of scope for authorization documentation.*

## Authorization architecture

This library implements a dual-path programmatic authorization architecture: a primary, actively-used path that delegates resource and role checks to a centralized WCF `SecurityService`, and a legacy path that calls a parallel ASMX `clsADServices` web service for resource-access checks and directory lookups not yet migrated. No AD resource or group names are hard-coded anywhere in this library — all resource/role/group names are caller-supplied strings; this is a mechanism layer, not a policy owner. No MVC `[SAIFAuthorize]` attributes, data-level ownership validators, or segregation-of-duties rules exist here.

```mermaid
flowchart TD
    Caller[Consuming application] --> Principal[clsSecurityPrincipal /<br>clsSecurityPrincipalCOM]
    Caller --> MachineSvc[Utilities.MachineSecurityService]
    Caller --> AccountProxy[clsAccountMaintProxy]
    Principal -->|IsAuthorized / IsInRole| WCFSvc[WCF SecurityService]
    MachineSvc -->|GetUsersByGroup| WCFSvc
    AccountProxy -->|HasAccess / HasAccessCache /<br>HasAccessExternal / HasAccessCacheExternal| ADSvc[(Legacy clsADServices.asmx)]
```

## AD resource catalog

**No static AD group/resource names are hard-coded anywhere in this library.** All resource/role/group names are caller-supplied at runtime — consuming applications pass the base resource name as a string argument, and this library appends the environment suffix and performs the lookup.

| Resource name | Purpose | Enforcement point | Source |
| --- | --- | --- | --- |
| `<caller-supplied base name>` | Base resource name passed by the calling application; suffixed `Resource` (Prod) or `TestResource` (non-Prod), then sent as `Domain\ResourceName<Suffix>` to the WCF `SecurityService` | `clsSecurityPrincipal.IsAuthorized(ResourceName)` | `SAIF.Framework.Security\clsSecurityPrincipal.vb` |
| `<caller-supplied role/resource name>` | Passed as `RoleName`; used as-is if already fully-qualified (`Domain\Name`), otherwise the current principal's domain is prefixed — no `Resource`/`TestResource` suffix is appended in this path | `clsSecurityPrincipal.IsInRole(RoleName)` | `SAIF.Framework.Security\clsSecurityPrincipal.vb` |
| `<caller-supplied group name>` | Base machine/service-account group name; suffix `Test`+`Resource` or `Resource` appended per `useProductionSecurityResource` flag | `Utilities.MachineSecurityService.IsAuthorized(machine, groupName, isResource, useProductionSecurityResource)` | `SAIF.Framework.Security\Utilities\MachineSecurityService.vb` |
| `<caller-supplied resource name>` | Legacy ASMX path; no suffixing logic present in the proxy itself (a plain `Test` suffix is applied one layer up, in `clsAccountMaintProxy`) | `ADServices.HasAccess` / `HasAccessExternal` / `HasAccessCache` / `HasAccessCacheExternal` / `WhoHasAccessCache` | `SAIF.Framework.Security\Web References\ADServices\Reference.vb` |

## Authorization enforcement points

This library exposes **programmatic** authorization enforcement points only — there are no MVC `[SAIFAuthorize]`/`[SaifAuthorize]` attributes here; this is the framework/plumbing layer consumed by such attributes in application repositories, not an MVC application itself.

### Programmatic authorization checks

| Class | Method | Resource / Role | Check type | Source |
| --- | --- | --- | --- | --- |
| `clsSecurityPrincipal` | `IsAuthorized(ResourceName As String)` | `ResourceName` (base name; env-aware overload) | `IsAuthorized` | `SAIF.Framework.Security\clsSecurityPrincipal.vb:239-247` |
| `clsSecurityPrincipal` | `IsAuthorized(ResourceName As String, Env As DevelopmentEnvironment)` | `ResourceName` + explicit environment | `IsAuthorized` | `SAIF.Framework.Security\clsSecurityPrincipal.vb:249-263` |
| `clsSecurityPrincipal` | `IsInRole(RoleName As String)` | `RoleName` (FQN or bare) | `IsInRole` | `SAIF.Framework.Security\clsSecurityPrincipal.vb:284-293` |
| `clsSecurityPrincipal` | `IsAuthorizedSecurityService(RoleName As String)` | Fully-qualified resource/role string (central WCF dispatch used by the checks above) | `IsAuthorized` | `SAIF.Framework.Security\clsSecurityPrincipal.vb:295-305` |
| `clsSecurityPrincipalCOM` | `IsAuthorized(Resource As String)` | `Resource` (COM-visible wrapper delegating to `clsSecurityPrincipal.IsAuthorized`) | `IsAuthorized` | `SAIF.Framework.Security\clsSecurityPrincipalCOM.vb:24-26` |
| `clsSecurityPrincipalCOM` | `IsInRole(Role As String)` | `Role` (COM-visible wrapper delegating to `clsSecurityPrincipal.IsInRole`) | `IsInRole` | `SAIF.Framework.Security\clsSecurityPrincipalCOM.vb:29-31` |
| `Utilities.MachineSecurityService` | `IsAuthorized(machine, groupName, isResource, useProductionSecurityResource)` | `groupName` (suffixed `Resource`/`TestResource` when `isResource=True`) | `HasAccess` (group-membership enumeration + in-process match, not a boolean service call) | `SAIF.Framework.Security\Utilities\MachineSecurityService.vb:20-38` |
| `ADServices.clsADServices` | `HasAccess(mailid, resourcename)` | `resourcename` (internal domain) | `HasAccess` | `SAIF.Framework.Security\Web References\ADServices\Reference.vb:364-390` |
| `ADServices.clsADServices` | `HasAccessExternal(mailid, resourcename)` | `resourcename` (external domain) | `HasAccess` | `SAIF.Framework.Security\Web References\ADServices\Reference.vb:391-417` |
| `ADServices.clsADServices` | `HasAccessCache(mailid, resourcename)` | `resourcename` (cached, internal domain) | `HasAccess` | `SAIF.Framework.Security\Web References\ADServices\Reference.vb:418-444` |
| `ADServices.clsADServices` | `HasAccessCacheExternal(mailid, resourcename)` | `resourcename` (cached, external domain) | `HasAccess` | `SAIF.Framework.Security\Web References\ADServices\Reference.vb:472-498` |

Not counted as an authorization enforcement point: `ADServices.clsADServices.WhoHasAccessCache` / `clsAccountMaintProxy.GetWhoHasAccess` — this enumerates group members rather than making a yes/no authorization decision (`SAIF.Framework.Security\clsAccountMaintProxy.vb:98-105`).

## Security interfaces and contracts

| Interface / Class | Role | Consumers | Source |
| --- | --- | --- | --- |
| `Utilities.IMachineSecurityService` | Contract for machine/service-account AD group authorization (`IsAuthorized`) | `Utilities.MachineSecurityService` | `SAIF.Framework.Security\Utilities\IMachineSecurityService.vb` |
| `clsSecurityPrincipal` | De facto security-manager/principal type: identity capture, NTLM authentication, and WCF authorization dispatch (does not implement a named `ISecurityManager`-style interface)* | `clsSecurityPrincipalCOM`, `clsSAIFLoginInfo`, consuming applications | `SAIF.Framework.Security\clsSecurityPrincipal.vb` |
| `clsSecurityPrincipalCOM` | COM-visible authorization wrapper for non-.NET/legacy Windows clients | External COM clients (consumers outside this repository)** | `SAIF.Framework.Security\clsSecurityPrincipalCOM.vb` |

No `ISecurityManager`, `IClaimSecurityManager`, `IDomainSecurityManager`, `SecurityManager`, `DomainSecurityManagerBase`, or `ClaimSecurityManager` types were found in this library.

## Notes
- Mark inferred statements with `*` and unknown statements with `**`. Do not use bold inline confidence labels.
- AD resource names listed here use base names only. The framework appends `Resource` (production) or `TestResource` (non-production) at runtime via the WCF path; the legacy ASMX path (`clsAccountMaintProxy`) appends only a plain `Test` suffix, an inconsistent convention relative to the WCF path.
- Data-level authorization, segregation-of-duties (SOD) rules, and attribute-based (`[SAIFAuthorize]`) enforcement were all searched for and not found in this library (counts: 0 for each).

## Related documentation
- [Index](index.md)
- [Overview](overview.md)
- [Architecture](architecture.md)
- [Dependencies](dependencies.md)
- [Operations and processes](operations-processes.md)
- [Business rules](business-rules.md)
- [Configuration](configuration.md)
- [API reference](api/index.md)

> **Note:** Statements marked with * were inferred from code structure, naming conventions, or
> contextual evidence where direct confirmation was not available in source artifacts. Statements
> marked with ** could not be confirmed; treat as unknown until verified.

## Sources
- `SAIF.Framework.Security\clsSecurityPrincipal.vb`
- `SAIF.Framework.Security\clsSecurityPrincipalCOM.vb`
- `SAIF.Framework.Security\clsAccountMaintProxy.vb`
- `SAIF.Framework.Security\Utilities\MachineSecurityService.vb`
- `SAIF.Framework.Security\Utilities\IMachineSecurityService.vb`
- `SAIF.Framework.Security\Service References\SecurityService\Reference.vb`
- `SAIF.Framework.Security\Web References\ADServices\Reference.vb`
- `SAIF.Framework.Security\app.config`