SAIF.Presentation.Web.Controls.PopUps.Infragistics111 security and authorization¶

This page documents authorization mechanisms implemented or consumed by this library. Authentication is handled entirely by infrastructure (NTLM/AD) and is not application-level — all code receives a WindowsIdentity on the request context. Authorization logic in this library is concentrated entirely in ImageMovePopup; the other seven controls implement no independent authorization checks of their own.

Authorization architecture¶

Authorization is performed via local, in-process programmatic checks against SAIF.Framework.Security.clsSecurityPrincipal and SAIF.Framework.Security.clsAccountMaintProxy, both wrapper types over the centralized SAIF AD/security infrastructure defined in the referenced SAIF.BOF.Framework.Security package. No WCF SecurityService endpoint, URL, or configuration key is defined directly in this library's own Web.config/app.config*. This is a WebForms control library, not MVC, so no [SAIFAuthorize]/[SaifAuthorize] declarative attributes are applicable or present.

The following diagram shows the claim-security authorization flow for ImageMovePopup, the only control with embedded authorization logic.

flowchart TD
    Caller["ImageMovePopup.EditContext()"] --> CCS["CheckClaimSecurity()"]
    CCS --> Domain{"mySecurity.Domain = SAIF?"}
    Domain -->|No| DenyAll["Deny outright<br>Only SAIF employee can view this page"]
    Domain -->|Yes| Flags["Evaluate IsConflict / IsExposure /<br>IsHealthIssue / IsHostileWorker"]
    Flags --> Principal["clsSecurityPrincipal.IsAuthorized(ADSG_*)<br>(current caller)"]
    Flags --> Proxy["clsAccountMaintProxy.ResourceAccessValidCached(mailId, ADSG_*)<br>(target Mail ID)"]
    Principal --> Outcome{"All held resources present?"}
    Proxy --> Outcome
    Outcome -->|Yes| Allow["outAllowAccess = True<br>Worker name shown"]
    Outcome -->|No| Deny["outAllowAccess = False<br>Name masked Confidential"]

AD resource catalog¶

Resource name	Purpose	Enforcement point	Source
`Image` (`ADSG_IMAGE`)	Grants the current user access to their own imaged documents; cached in `myImageSecurity.HasImage` and reused by `CheckImageSecurity` when the target Mail ID equals the caller (BR-IMG-006).	`ImageMovePopup.SetSecurityUserImage()`, `ImageMovePopup.CheckImageSecurity()`	`SAIF.Presentation.Web.Controls.PopUps.Infragistics111\ImageMovePopup.vb`
`ImagePolicy` (`ADSG_IMAGE_POLICY`)	Cached flag intended for policy-image access; not observed to gate any branch beyond population**	`ImageMovePopup.SetSecurityUserImage()`	`SAIF.Presentation.Web.Controls.PopUps.Infragistics111\ImageMovePopup.vb`
`ImageClaim` (`ADSG_IMAGE_CLAIM`)	Cached flag intended for claim-image access; not observed to gate any branch beyond population**	`ImageMovePopup.SetSecurityUserImage()`	`SAIF.Presentation.Web.Controls.PopUps.Infragistics111\ImageMovePopup.vb`
`IDAAlertAdmin` (`ADSG_IMAGE_ALERT_ADMIN`)	Cached admin flag intended for image-alert administration; not observed to gate any branch beyond population**	`ImageMovePopup.SetSecurityUserImage()`	`SAIF.Presentation.Web.Controls.PopUps.Infragistics111\ImageMovePopup.vb`
`IDAListAdmin` (`ADSG_IMAGE_LIST_ADMIN`)	Cached admin flag intended for image-list administration; not observed to gate any branch beyond population**	`ImageMovePopup.SetSecurityUserImage()`	`SAIF.Presentation.Web.Controls.PopUps.Infragistics111\ImageMovePopup.vb`
`IDAQueueAdmin` (`ADSG_IMAGE_QUEUE_ADMIN`)	Cached admin flag intended for image-queue administration; not observed to gate any branch beyond population**	`ImageMovePopup.SetSecurityUserImage()`	`SAIF.Presentation.Web.Controls.PopUps.Infragistics111\ImageMovePopup.vb`
`ConflictClaim` (`ADSG_CLAIM_CONFLICT`)	View access to claims flagged conflict-of-interest (`IsConflict`) (BR-IMG-002)	`ImageMovePopup.CheckClaimSecurity()` (live enforcement); also cache-populated in `SetSecurityUserImage()` (cache-only, not itself observed to gate a branch)	`SAIF.Presentation.Web.Controls.PopUps.Infragistics111\ImageMovePopup.vb`
`ImageSecure` (`ADSG_IMAGE_SECURE`)	Declared constant; no call site using it was found in the reviewed file — appears vestigial or reserved**	n/a — declared, never referenced	`SAIF.Presentation.Web.Controls.PopUps.Infragistics111\ImageMovePopup.vb`
`ExposureClaim` (`ADSG_CLAIM_EXPOSURE`)	View access to claims flagged `IsExposure` (BR-IMG-003)	`ImageMovePopup.CheckClaimSecurity()`	`SAIF.Presentation.Web.Controls.PopUps.Infragistics111\ImageMovePopup.vb`
`CollateralHealthClaim` (`ADSG_CLAIM_COLLATERAL`)	View access to claims flagged `IsHealthIssue` (BR-IMG-003)	`ImageMovePopup.CheckClaimSecurity()`	`SAIF.Presentation.Web.Controls.PopUps.Infragistics111\ImageMovePopup.vb`
`SecureClaim` (`ADSG_CLAIM_SECURE`)	View access to claims flagged `IsHostileWorker` (BR-IMG-003)	`ImageMovePopup.CheckClaimSecurity()`	`SAIF.Presentation.Web.Controls.PopUps.Infragistics111\ImageMovePopup.vb`

11 Private Const ADSG_* constants are declared in ImageMovePopup.vb (lines 93–103), of which 9 are distinct resource-name strings after accounting for naming (ImageSecure is declared but never called). Per SAIF naming convention, each base resource name above is expanded by clsSecurityPrincipal.IsAuthorized/clsAccountMaintProxy.ResourceAccessValidCached at call time to <ResourceName>Resource (production) or <ResourceName>TestResource (non-production); the environment suffix is applied internally by the referenced SAIF.BOF.Framework.Security package and is not constructed in this library's own code*.

Authorization enforcement points¶

Programmatic authorization checks¶

Class	Method	Resource / Role	Check type	Source
`ImageMovePopup`	`SetSecurityUserImage()`	`ADSG_IMAGE`, `ADSG_IMAGE_POLICY`, `ADSG_IMAGE_CLAIM`, `ADSG_IMAGE_ALERT_ADMIN`, `ADSG_IMAGE_LIST_ADMIN`, `ADSG_IMAGE_QUEUE_ADMIN`, `ADSG_CLAIM_CONFLICT`	`IsAuthorized` (cache-population helper; guarded by `Domain = "SAIF"`)	`SAIF.Presentation.Web.Controls.PopUps.Infragistics111\ImageMovePopup.vb`
`ImageMovePopup`	`CheckImageSecurity(inImageFileCode, inMailId)`	`ADSG_IMAGE` (self-check path); delegated `ImageServices.HasADAccessToImageResource` (target Mail ID path)	`IsAuthorized` / delegated external check	`SAIF.Presentation.Web.Controls.PopUps.Infragistics111\ImageMovePopup.vb`
`ImageMovePopup`	`CheckClaimSecurity(inClaimSecurity, inMailId, outAllowAccess, outError)`	`ADSG_CLAIM_CONFLICT`, `ADSG_CLAIM_EXPOSURE`, `ADSG_CLAIM_COLLATERAL`, `ADSG_CLAIM_SECURE`	`IsAuthorized` (current caller) / `ResourceAccessValidCached` (target Mail ID)	`SAIF.Presentation.Web.Controls.PopUps.Infragistics111\ImageMovePopup.vb`

No declarative (attribute-based) authorization exists in this library (WebForms, not MVC).

Data-level authorization¶

Entity type	Validation method	Mechanism	Source
Claim (`clsClaimData.strClaimSecurity`)	`ImageMovePopup.CheckClaimSecurity`	Combines 4 boolean identity/classification attributes on the claim (`IsConflict`, `IsExposure`, `IsHealthIssue`, `IsHostileWorker`) with 4 corresponding AD-resource-membership checks — a claim is visible only if, for every classification flag set `True` on the claim, the caller (or target Mail ID) holds the matching AD resource. The entire check set is additionally gated behind `mySecurity.Domain = "SAIF"` (BR-IMG-004). Only claim-level scope is enforced this way; no equivalent ownership/scope check exists for policy data in this library*	`SAIF.Presentation.Web.Controls.PopUps.Infragistics111\ImageMovePopup.vb`

Segregation of duties¶

None found. No *SegregationOfDuties*/*SOD* classes or methods, employee_access/menu_structure-style privilege-combination queries, or business rule preventing a single user from holding mutually exclusive permissions were found anywhere in this library's source.

Security interfaces and contracts¶

Interface / Class	Role	Consumers	Source
`SAIF.Framework.Security.clsSecurityPrincipal`	Security manager type exposing `IsAuthorized(ResourceName)`, `Domain`, `UserName` for the current caller	`ImageMovePopup` (instance field `mySecurity`)	`SAIF.Presentation.Web.Controls.PopUps.Infragistics111\ImageMovePopup.vb`
`SAIF.Framework.Security.clsAccountMaintProxy`	Security proxy type exposing `ResourceAccessValidCached(mailId, resourceName)` for a delegated/target Mail ID	`ImageMovePopup` (local instance `mySecuritySystem`)	`SAIF.Presentation.Web.Controls.PopUps.Infragistics111\ImageMovePopup.vb`

Both types are defined in the externally-referenced SAIF.BOF.Framework.Security package, not in this library, and are consumed exclusively by ImageMovePopup.vb; no other file in this library references either type.

Machine application authorization¶

A fixed system-mailbox allow-list functions as a machine/application-identity bypass, rather than true machine-account (SAMAccountName/$-suffix) AD group validation. ImageMovePopup.CheckImageSecurity() begins with a Select Case inMailId.ToUpper enumerating 6 constants from the referenced clsMessages type (ARSK_MAILID, LEGAL_MAILID, THIRD_PARTY_MAILID, CBP_MAILID, SERVICE_MAILID, PLUS_MAILID) (BR-IMG-005). For any of these 6 target Mail IDs, the method returns True unconditionally — no AD group membership check is performed at all for these identities. The literal string/email values behind these clsMessages.*_MAILID constants are not defined in this library**.

Notes¶

Coverage assessment: authorization coverage in this library is narrow and concentrated entirely in ImageMovePopup — the library's other 5 popup controls (ClaimActivityPopup, EFTPopup, NotifyPopup, PolicyActivityPopup, TODOPopupControl) and shared helpers (PopUpButton, PopupControl, mdlUtilities) implement no independent authorization logic of their own and rely on no security manager types*.
Whether clsSecurityPrincipal/clsAccountMaintProxy internally route to a WCF SecurityService cannot be confirmed from this library alone (requires tracing into the referenced SAIF.BOF.Framework.Security package)**.
The external caller(s) of the public CheckImageSecurity method (and whether any caller ever supplies a non-empty inMailId to CheckClaimSecurity, exercising the target-Mail-ID/clsAccountMaintProxy path) were not identified from this library's own source**.
Mark inferred statements with * and unknown statements with **. Do not use bold inline confidence labels.
AD resource names listed here use base names only. The framework appends Resource (production) or TestResource (non-production) at runtime.

Note: Statements marked with * were inferred from code structure, naming conventions, or contextual evidence where direct confirmation was not available in source artifacts. Statements marked with ** could not be confirmed; treat as unknown until verified.

Sources¶

SAIF.Presentation.Web.Controls.PopUps.Infragistics111\ImageMovePopup.vb