---
title: SAIF.Framework.SecurityModule dependencies
summary: Internal and external dependencies for this library.
status: draft
owner: <owner>
last_reviewed: 2026-07-23
library: SAIF.Framework.SecurityModule
reference_type: package
---

# SAIF.Framework.SecurityModule dependencies

SAIF.Framework.SecurityModule has no internal repository dependencies; it relies on the .NET Framework base class library, an external `log4net` assembly, and several unmanaged Win32 APIs to implement its `IHttpModule`-based authentication pipeline.

## Internal dependencies

None detected. The library's project file (`SAIF.Framework.SecurityModule\SAIF.Framework.SecurityModule.vbproj`) contains no `<ProjectReference>` elements, so it does not reference any other SAIF.Framework.* project in the repository.*

| Dependency | Type | Usage |
| --- | --- | --- |
| None | — | — |

## External dependencies
| Dependency | Version | Usage |
| --- | --- | --- |
| System.Web (`IHttpModule`) | Framework-standard (.NET Framework v3.5) | `clsSecurityModule` implements `System.Web.IHttpModule` to hook into the ASP.NET request pipeline and handle `HttpApplication.AuthenticateRequest`. Source: `SAIF.Framework.SecurityModule\clsSecurityModule.vb` |
| log4net | v1.2.11.0 (local `HintPath` reference to `..\..\..\Libs\Log4Net\log4net.dll`, not a NuGet package) | Backing logging provider for `mdlLogging`'s `Log`/`LogInfo`/`LogWarn`/`LogError`/`LogDebug` facility, configured via the assembly-level `log4net.Config.XmlConfigurator(ConfigFile:="..\log4net.config")` attribute. Source: `SAIF.Framework.SecurityModule\SAIF.Framework.SecurityModule.vbproj`, `SAIF.Framework.SecurityModule\mdlLogging.vb`, `SAIF.Framework.SecurityModule\clsSecurityModule.vb` |
| System, System.configuration, System.Data, System.Web.Extensions, System.Xml, System.Core, System.Xml.Linq, System.Data.DataSetExtensions | .NET Framework BCL (framework-standard, v3.5) | Standard framework references declared in the project file; `System.Configuration.ConfigurationManager.AppSettings` is used directly to read module settings. Source: `SAIF.Framework.SecurityModule\SAIF.Framework.SecurityModule.vbproj` |
| advapi32.dll, Kernel32.dll | Unmanaged Win32 API (P/Invoke) | `TokenProvider` calls Win32 `LogonUser`/`DuplicateToken`/token-handle functions to exchange decrypted credentials for a Windows logon token. Source: `SAIF.Framework.SecurityModule\TokenProvider.vb` |
| crypt32.dll (`c:\windows\system32\crypt32.dll`) | Unmanaged Win32 API (P/Invoke, DPAPI) | `DPAPI` calls Win32 `CryptProtectData`/`CryptUnprotectData` to encrypt/decrypt the `SAIFAUTH` cookie value and other secrets. Source: `SAIF.Framework.SecurityModule\DAPIEncrypt.vb` |

Target framework: `v3.5` (`TargetFrameworkVersion` in the `.vbproj`). No `packages.config` or `<PackageReference>` items exist in this project — no NuGet package dependencies were detected.*

## Dependency risks and notes
- The library targets .NET Framework `v3.5`, an out-of-support runtime version, which constrains modernization and patching options.*
- `log4net` is referenced via a local `HintPath` (`..\..\..\Libs\Log4Net\log4net.dll`) rather than a versioned NuGet package, so updates must be managed manually across the repository's `Libs\` folder rather than through package restore.
- Authentication correctness depends on unmanaged Win32 APIs (`advapi32.dll`, `Kernel32.dll`, `crypt32.dll`) via P/Invoke, tying the module to the Windows platform and to machine/user-scoped DPAPI keys; this also requires the assembly-level `SecurityPermissionAttribute(SecurityAction.RequestMinimum, UnmanagedCode:=True)` grant declared in `clsSecurityModule.vb` and `DAPIEncrypt.vb`.
- No `Web.config`/`App.config` exists inside this library's own folder, so the module's registration as an `IHttpModule` and the effective values of its `AppSettings` keys (`sec-errorpage`, `ExternalHostNames`, `sec-loginpage`, `sec-browser-authtype`, `sec-logindomain`) can only be confirmed by inspecting a consuming host application's configuration.**
- As a leaf library with no internal `<ProjectReference>` dependencies, changes to this module carry no transitive build risk to other SAIF.Framework.* projects, but any hosting web application registering `clsSecurityModule` is directly coupled to its behavior.*

> **Note:** Statements marked with * were inferred from code structure, naming conventions, or
> contextual evidence where direct confirmation was not available in source artifacts. Statements
> marked with ** could not be confirmed; treat as unknown until verified.

## Related documentation
- [Index](index.md)
- [Overview](overview.md)
- [Architecture](architecture.md)
- [Operations and processes](operations-processes.md)
- [Business rules](business-rules.md)
- [Configuration](configuration.md)
- [API reference](api/index.md)

## Sources
- `SAIF.Framework.SecurityModule\SAIF.Framework.SecurityModule.vbproj`
- `SAIF.Framework.SecurityModule\clsSecurityModule.vb`
- `SAIF.Framework.SecurityModule\mdlLogging.vb`
- `SAIF.Framework.SecurityModule\TokenProvider.vb`
- `SAIF.Framework.SecurityModule\DAPIEncrypt.vb`