---
title: SAIF.Framework.SecurityModule configuration settings
summary: Configuration keys consumed by this library, retrieval methods, and runtime dependencies.
status: draft
owner: <owner>
last_reviewed: 2026-07-23
library: SAIF.Framework.SecurityModule
reference_type: package
---

# Configuration settings

`SAIF.Framework.SecurityModule` reads five `ConfigurationManager.AppSettings` keys to steer its ASP.NET authentication pipeline: error-page routing, host classification, external-login redirect, browser challenge type, and the Windows logon domain. No `IEnvironmentService`, typed settings with defined values, database connection configuration, or secure-setting retrieval calls were found.

## Configuration retrieval methods

| Method | Class / Interface | Namespace | Usage pattern |
| --- | --- | --- | --- |
| ConfigurationManager.AppSettings | `clsSecurityModule`, `UserAuthenticator`, `TokenProvider` | `SAIF.Framework.SecurityModule` | Reads request-pipeline settings (`sec-errorpage`, `ExternalHostNames`, `sec-loginpage`, `sec-browser-authtype`, `sec-logindomain`) at authentication time. |

## Environment API settings

None detected.

## AppSettings (Web.config)

Settings retrieved via `ConfigurationManager.AppSettings`.

| Setting key | Default value | Purpose | Consuming class | Source |
| --- | --- | --- | --- | --- |
| `sec-errorpage` | `/WebError/ProcessError.aspx` (code fallback) | Redirect target for unhandled authentication exceptions. | `clsSecurityModule` | `SAIF.Framework.SecurityModule\clsSecurityModule.vb` |
| `ExternalHostNames` | None declared in this library | Case-insensitive host-name catalog used to choose the external vs. internal authentication fallback path. | `UserAuthenticator` | `SAIF.Framework.SecurityModule\Authenticators\UserAuthenticator.vb` |
| `sec-loginpage` | `/onlinelogin/loginscreen.aspx` (code fallback) | Redirect target for external users when cookie authentication fails. | `ExternalUserAuthenticator` | `SAIF.Framework.SecurityModule\Authenticators\UserAuthenticator.vb` |
| `sec-browser-authtype` | `NTLM` (code fallback) | Primary `WWW-Authenticate` scheme used for internal-host browser challenges. | `InternalUserAuthenticator`, `BrowserAuthenticator` | `SAIF.Framework.SecurityModule\Authenticators\UserAuthenticator.vb`, `SAIF.Framework.SecurityModule\Authenticators\BrowserAuthenticator.vb` |
| `sec-logindomain` | None declared in this library | Domain argument passed to Win32 `LogonUser` during cookie-based re-authentication. | `TokenProvider` | `SAIF.Framework.SecurityModule\TokenProvider.vb` |

## Database connection configuration

None detected.

## Secure settings

None detected.

## Transitive configuration (from dependencies)

None detected.

## Configuration dependencies

| Dependency | Type | Required at | Impact if missing |
| --- | --- | --- | --- |
| `ExternalHostNames` | `appSettings` | Request-time | `UserAuthenticator.Find` treats every host as internal when the value is empty/missing, so failed cookie authentication falls back to the browser challenge path instead of the external login redirect. |
| `sec-loginpage` | `appSettings` | Request-time | External-user fallback redirects use the built-in `/onlinelogin/loginscreen.aspx` default when the setting is missing. |
| `sec-browser-authtype` | `appSettings` | Request-time | Browser challenges use the built-in `NTLM` default when the setting is missing. |
| `sec-logindomain` | `appSettings` | Request-time | `TokenProvider` passes this value directly to Win32 `LogonUser` when exchanging cookie credentials for a Windows token; unsuccessful Windows logon raises `Unable to login`. |
| `sec-errorpage` | `appSettings` | Request-time | Exception redirects use the built-in `/WebError/ProcessError.aspx` default when the setting is missing. |

## Related documentation

- [Library index](index.md)

- [Overview](overview.md)

- [Architecture](architecture.md)

- [Dependencies](dependencies.md)

- [Operations and processes](operations-processes.md)

- [Business rules](business-rules.md)

- [API reference](api/index.md)

## Sources

- `SAIF.Framework.SecurityModule\clsSecurityModule.vb`

- `SAIF.Framework.SecurityModule\Authenticators\UserAuthenticator.vb`

- `SAIF.Framework.SecurityModule\Authenticators\BrowserAuthenticator.vb`

- `SAIF.Framework.SecurityModule\Authenticators\CookieAuthenticator.vb`

- `SAIF.Framework.SecurityModule\TokenProvider.vb`

- `SAIF.Framework.SecurityModule\My Project\Settings.settings`

- `SAIF.Framework.SecurityModule\My Project\Settings.Designer.vb`

- `SAIF.Framework.SecurityModule\SAIF.Framework.SecurityModule.vbproj`