--- title: SAIF.Presentation.Web.Controls.PopUps.Infragistics111 security and authorization summary: Authorization requirements, AD resource groups, security enforcement points, and data-level access control. status: draft owner: last_reviewed: 2026-08-21 library: SAIF.Presentation.Web.Controls.PopUps.Infragistics111 reference_type: package --- # SAIF.Presentation.Web.Controls.PopUps.Infragistics111 security and authorization This page documents authorization mechanisms implemented or consumed by this library. Authentication is handled entirely by infrastructure (NTLM/AD) and is not application-level — all code receives a `WindowsIdentity` on the request context. Authorization logic in this library is concentrated entirely in `ImageMovePopup`; the other seven controls implement no independent authorization checks of their own. ## Authorization architecture Authorization is performed via local, in-process programmatic checks against `SAIF.Framework.Security.clsSecurityPrincipal` and `SAIF.Framework.Security.clsAccountMaintProxy`, both wrapper types over the centralized SAIF AD/security infrastructure defined in the referenced `SAIF.BOF.Framework.Security` package. No WCF `SecurityService` endpoint, URL, or configuration key is defined directly in this library's own `Web.config`/`app.config`*. This is a WebForms control library, not MVC, so no `[SAIFAuthorize]`/`[SaifAuthorize]` declarative attributes are applicable or present. The following diagram shows the claim-security authorization flow for `ImageMovePopup`, the only control with embedded authorization logic. ```mermaid flowchart TD Caller["ImageMovePopup.EditContext()"] --> CCS["CheckClaimSecurity()"] CCS --> Domain{"mySecurity.Domain = SAIF?"} Domain -->|No| DenyAll["Deny outright
Only SAIF employee can view this page"] Domain -->|Yes| Flags["Evaluate IsConflict / IsExposure /
IsHealthIssue / IsHostileWorker"] Flags --> Principal["clsSecurityPrincipal.IsAuthorized(ADSG_*)
(current caller)"] Flags --> Proxy["clsAccountMaintProxy.ResourceAccessValidCached(mailId, ADSG_*)
(target Mail ID)"] Principal --> Outcome{"All held resources present?"} Proxy --> Outcome Outcome -->|Yes| Allow["outAllowAccess = True
Worker name shown"] Outcome -->|No| Deny["outAllowAccess = False
Name masked Confidential"] ``` ## AD resource catalog | Resource name | Purpose | Enforcement point | Source | | --- | --- | --- | --- | | `Image` (`ADSG_IMAGE`) | Grants the current user access to their own imaged documents; cached in `myImageSecurity.HasImage` and reused by `CheckImageSecurity` when the target Mail ID equals the caller ([BR-IMG-006](business-rules.md#br-img-006-image-access-for-the-current-user-vs.-a-delegated-mail-id-uses-different-authorization-sources)). | `ImageMovePopup.SetSecurityUserImage()`, `ImageMovePopup.CheckImageSecurity()` | `SAIF.Presentation.Web.Controls.PopUps.Infragistics111\ImageMovePopup.vb` | | `ImagePolicy` (`ADSG_IMAGE_POLICY`) | Cached flag intended for policy-image access; not observed to gate any branch beyond population** | `ImageMovePopup.SetSecurityUserImage()` | `SAIF.Presentation.Web.Controls.PopUps.Infragistics111\ImageMovePopup.vb` | | `ImageClaim` (`ADSG_IMAGE_CLAIM`) | Cached flag intended for claim-image access; not observed to gate any branch beyond population** | `ImageMovePopup.SetSecurityUserImage()` | `SAIF.Presentation.Web.Controls.PopUps.Infragistics111\ImageMovePopup.vb` | | `IDAAlertAdmin` (`ADSG_IMAGE_ALERT_ADMIN`) | Cached admin flag intended for image-alert administration; not observed to gate any branch beyond population** | `ImageMovePopup.SetSecurityUserImage()` | `SAIF.Presentation.Web.Controls.PopUps.Infragistics111\ImageMovePopup.vb` | | `IDAListAdmin` (`ADSG_IMAGE_LIST_ADMIN`) | Cached admin flag intended for image-list administration; not observed to gate any branch beyond population** | `ImageMovePopup.SetSecurityUserImage()` | `SAIF.Presentation.Web.Controls.PopUps.Infragistics111\ImageMovePopup.vb` | | `IDAQueueAdmin` (`ADSG_IMAGE_QUEUE_ADMIN`) | Cached admin flag intended for image-queue administration; not observed to gate any branch beyond population** | `ImageMovePopup.SetSecurityUserImage()` | `SAIF.Presentation.Web.Controls.PopUps.Infragistics111\ImageMovePopup.vb` | | `ConflictClaim` (`ADSG_CLAIM_CONFLICT`) | View access to claims flagged conflict-of-interest (`IsConflict`) ([BR-IMG-002](business-rules.md#br-img-002-conflict-claim-visibility-requires-the-conflictclaim-(adsg_claim_conflict)-ad-resource)) | `ImageMovePopup.CheckClaimSecurity()` (live enforcement); also cache-populated in `SetSecurityUserImage()` (cache-only, not itself observed to gate a branch) | `SAIF.Presentation.Web.Controls.PopUps.Infragistics111\ImageMovePopup.vb` | | `ImageSecure` (`ADSG_IMAGE_SECURE`) | Declared constant; no call site using it was found in the reviewed file — appears vestigial or reserved** | n/a — declared, never referenced | `SAIF.Presentation.Web.Controls.PopUps.Infragistics111\ImageMovePopup.vb` | | `ExposureClaim` (`ADSG_CLAIM_EXPOSURE`) | View access to claims flagged `IsExposure` ([BR-IMG-003](business-rules.md#br-img-003-exposure-claim%2C-collateral-health%2C-and-hostile-worker-claim-visibility-each-require-a-distinct-ad-resource)) | `ImageMovePopup.CheckClaimSecurity()` | `SAIF.Presentation.Web.Controls.PopUps.Infragistics111\ImageMovePopup.vb` | | `CollateralHealthClaim` (`ADSG_CLAIM_COLLATERAL`) | View access to claims flagged `IsHealthIssue` ([BR-IMG-003](business-rules.md#br-img-003-exposure-claim%2C-collateral-health%2C-and-hostile-worker-claim-visibility-each-require-a-distinct-ad-resource)) | `ImageMovePopup.CheckClaimSecurity()` | `SAIF.Presentation.Web.Controls.PopUps.Infragistics111\ImageMovePopup.vb` | | `SecureClaim` (`ADSG_CLAIM_SECURE`) | View access to claims flagged `IsHostileWorker` ([BR-IMG-003](business-rules.md#br-img-003-exposure-claim%2C-collateral-health%2C-and-hostile-worker-claim-visibility-each-require-a-distinct-ad-resource)) | `ImageMovePopup.CheckClaimSecurity()` | `SAIF.Presentation.Web.Controls.PopUps.Infragistics111\ImageMovePopup.vb` | 11 `Private Const ADSG_*` constants are declared in `ImageMovePopup.vb` (lines 93–103), of which 9 are distinct resource-name strings after accounting for naming (`ImageSecure` is declared but never called). Per SAIF naming convention, each base resource name above is expanded by `clsSecurityPrincipal.IsAuthorized`/`clsAccountMaintProxy.ResourceAccessValidCached` at call time to `Resource` (production) or `TestResource` (non-production); the environment suffix is applied internally by the referenced `SAIF.BOF.Framework.Security` package and is not constructed in this library's own code*. ## Authorization enforcement points ### Programmatic authorization checks | Class | Method | Resource / Role | Check type | Source | | --- | --- | --- | --- | --- | | `ImageMovePopup` | `SetSecurityUserImage()` | `ADSG_IMAGE`, `ADSG_IMAGE_POLICY`, `ADSG_IMAGE_CLAIM`, `ADSG_IMAGE_ALERT_ADMIN`, `ADSG_IMAGE_LIST_ADMIN`, `ADSG_IMAGE_QUEUE_ADMIN`, `ADSG_CLAIM_CONFLICT` | `IsAuthorized` (cache-population helper; guarded by `Domain = "SAIF"`) | `SAIF.Presentation.Web.Controls.PopUps.Infragistics111\ImageMovePopup.vb` | | `ImageMovePopup` | `CheckImageSecurity(inImageFileCode, inMailId)` | `ADSG_IMAGE` (self-check path); delegated `ImageServices.HasADAccessToImageResource` (target Mail ID path) | `IsAuthorized` / delegated external check | `SAIF.Presentation.Web.Controls.PopUps.Infragistics111\ImageMovePopup.vb` | | `ImageMovePopup` | `CheckClaimSecurity(inClaimSecurity, inMailId, outAllowAccess, outError)` | `ADSG_CLAIM_CONFLICT`, `ADSG_CLAIM_EXPOSURE`, `ADSG_CLAIM_COLLATERAL`, `ADSG_CLAIM_SECURE` | `IsAuthorized` (current caller) / `ResourceAccessValidCached` (target Mail ID) | `SAIF.Presentation.Web.Controls.PopUps.Infragistics111\ImageMovePopup.vb` | No declarative (attribute-based) authorization exists in this library (WebForms, not MVC). ## Data-level authorization | Entity type | Validation method | Mechanism | Source | | --- | --- | --- | --- | | Claim (`clsClaimData.strClaimSecurity`) | `ImageMovePopup.CheckClaimSecurity` | Combines 4 boolean identity/classification attributes on the claim (`IsConflict`, `IsExposure`, `IsHealthIssue`, `IsHostileWorker`) with 4 corresponding AD-resource-membership checks — a claim is visible only if, for every classification flag set `True` on the claim, the caller (or target Mail ID) holds the matching AD resource. The entire check set is additionally gated behind `mySecurity.Domain = "SAIF"` ([BR-IMG-004](business-rules.md#br-img-004-claim-security-checks-are-enforced-only-for-the-saif-domain%3B-non-saif-callers-are-denied-outright)). Only claim-level scope is enforced this way; no equivalent ownership/scope check exists for policy data in this library* | `SAIF.Presentation.Web.Controls.PopUps.Infragistics111\ImageMovePopup.vb` | ## Segregation of duties None found. No `*SegregationOfDuties*`/`*SOD*` classes or methods, `employee_access`/`menu_structure`-style privilege-combination queries, or business rule preventing a single user from holding mutually exclusive permissions were found anywhere in this library's source. ## Security interfaces and contracts | Interface / Class | Role | Consumers | Source | | --- | --- | --- | --- | | `SAIF.Framework.Security.clsSecurityPrincipal` | Security manager type exposing `IsAuthorized(ResourceName)`, `Domain`, `UserName` for the current caller | `ImageMovePopup` (instance field `mySecurity`) | `SAIF.Presentation.Web.Controls.PopUps.Infragistics111\ImageMovePopup.vb` | | `SAIF.Framework.Security.clsAccountMaintProxy` | Security proxy type exposing `ResourceAccessValidCached(mailId, resourceName)` for a delegated/target Mail ID | `ImageMovePopup` (local instance `mySecuritySystem`) | `SAIF.Presentation.Web.Controls.PopUps.Infragistics111\ImageMovePopup.vb` | Both types are defined in the externally-referenced `SAIF.BOF.Framework.Security` package, not in this library, and are consumed exclusively by `ImageMovePopup.vb`; no other file in this library references either type. ## Machine application authorization A **fixed system-mailbox allow-list** functions as a machine/application-identity bypass, rather than true machine-account (SAMAccountName/`$`-suffix) AD group validation. `ImageMovePopup.CheckImageSecurity()` begins with a `Select Case inMailId.ToUpper` enumerating 6 constants from the referenced `clsMessages` type (`ARSK_MAILID`, `LEGAL_MAILID`, `THIRD_PARTY_MAILID`, `CBP_MAILID`, `SERVICE_MAILID`, `PLUS_MAILID`) ([BR-IMG-005](business-rules.md#br-img-005-certain-system-mailboxes-are-always-allowed-to-receive-image-alerts)). For any of these 6 target Mail IDs, the method returns `True` unconditionally — no AD group membership check is performed at all for these identities. The literal string/email values behind these `clsMessages.*_MAILID` constants are not defined in this library**. ## Notes - Coverage assessment: authorization coverage in this library is narrow and concentrated entirely in `ImageMovePopup` — the library's other 5 popup controls (`ClaimActivityPopup`, `EFTPopup`, `NotifyPopup`, `PolicyActivityPopup`, `TODOPopupControl`) and shared helpers (`PopUpButton`, `PopupControl`, `mdlUtilities`) implement no independent authorization logic of their own and rely on no security manager types*. - Whether `clsSecurityPrincipal`/`clsAccountMaintProxy` internally route to a WCF `SecurityService` cannot be confirmed from this library alone (requires tracing into the referenced `SAIF.BOF.Framework.Security` package)**. - The external caller(s) of the public `CheckImageSecurity` method (and whether any caller ever supplies a non-empty `inMailId` to `CheckClaimSecurity`, exercising the target-Mail-ID/`clsAccountMaintProxy` path) were not identified from this library's own source**. - Mark inferred statements with `*` and unknown statements with `**`. Do not use bold inline confidence labels. - AD resource names listed here use base names only. The framework appends `Resource` (production) or `TestResource` (non-production) at runtime. ## Related documentation - [Index](index.md) - [Overview](overview.md) - [Architecture](architecture.md) - [Dependencies](dependencies.md) - [Operations and processes](operations-processes.md) - [Business rules](business-rules.md) - [Control catalog](control-catalog.md) - [Configuration settings](configuration.md) - [API reference](api/index.md) > **Note:** Statements marked with `*` were inferred from code structure, naming > conventions, or contextual evidence where direct confirmation was not available > in source artifacts. Statements marked with `**` could not be confirmed; treat > as unknown until verified. ## Sources - `SAIF.Presentation.Web.Controls.PopUps.Infragistics111\ImageMovePopup.vb`