clsSecurityModule

clsSecurityModule is the ASP.NET IHttpModule pipeline entry point for this library. It registers an AuthenticateRequest handler that drives the entire authentication flow — short-circuiting already-authenticated users, delegating to the internal/external authenticator strategy, and routing unhandled exceptions to a configured error page.

Purpose

• Hook into the ASP.NET request pipeline and orchestrate authentication for every inbound request.
• Own top-level exception handling for the authentication flow, distinguishing benign Response.Redirect-induced ThreadAbortExceptions from real errors.

Context

• Namespace: SAIF.Framework.SecurityModule
• Assembly/package: SAIF.Framework.SecurityModule (packaged inside the SAIF.BOF.Framework NuGet package)

Public members

Member	Signature	Purpose
ErrorPage	Public ReadOnly Property ErrorPage As String	Returns the configured error page URL (sec-errorpage app setting), defaulting to /WebError/ProcessError.aspx if not set.
Dispose	Public Sub Dispose()	IHttpModule.Dispose implementation; performs no cleanup (empty body).
Init	Public Sub Init(context As HttpApplication)	IHttpModule.Init implementation; wires AuthRequest_Handler to context.AuthenticateRequest.
AuthRequest_Handler	Protected Sub AuthRequest_Handler(sender As Object, e As EventArgs)	Core authentication flow: resolves already-authenticated short-circuit, selects an authenticator via UserAuthenticator.Find, invokes Authenticate, and handles exceptions (see BR-005, BR-006).

Behavioral notes

• Implements System.Web.IHttpModule, so a hosting web application must register it in Web.config's <httpModules> / <system.webServer><modules> section for the module to take effect; no such registration exists inside this library's own folder to confirm.**
• On entry, AuthRequest_Handler logs "Begin"/"End" via mdlLogging and checks BR-001 before delegating to UserAuthenticator.Find.
• Carries assembly-level <Assembly: log4net.Config.XmlConfigurator(ConfigFile:="..\log4net.config")> and <Assembly: SecurityPermissionAttribute(SecurityAction.RequestMinimum, UnmanagedCode:=True)> attributes, reflecting the module's reliance on log4net configuration and unmanaged P/Invoke calls elsewhere in the library.

Constraints and usage notes

• The class does not expose a constructor beyond the implicit default; it is expected to be instantiated by the ASP.NET runtime as a registered IHttpModule, not constructed directly by application code.*
• ErrorPage is evaluated once as a property initializer at construction time, not re-read from AppSettings on each request.

Note: Statements marked with * were inferred from code structure, naming conventions, or contextual evidence where direct confirmation was not available in source artifacts. Statements marked with ** could not be confirmed; treat as unknown until verified.

Sources

• SAIF.Framework.SecurityModule\clsSecurityModule.vb