Skip to content

Recompute per-claim access flags

This operation is the composite confidentiality evaluator: it resets each of the four access flags to permissive and denies only the dimensions a specific claim actually triggers.

Field Value
Operation ID OP-CLM-3
Trigger ClaimAppManager.OnCheckSecurity (step 1), or a direct call by a consumer
Inputs clsClaimData
Outputs Four boolean access flags (ConflictAccess, ExposureAccess, HealthIssueAccess, SecureClaimAccess)
Primary components ClaimSecurity.CheckClaim
Entry point SAIF.Application.Claim/ClaimSecurity.vb

Steps

Each flag is reset to True before evaluation — a permissive default.

  1. m_ConflictAccess = False when inClaim.IsWorkerConflict and Not UserAccess.ConflictAccess (BR-CLM-007).
  2. m_ExposureAccess = False when inClaim.IsExposure and Not UserAccess.ExposureAccess (BR-CLM-008).
  3. m_HealthIssueAccess = False when inClaim.IsHealthIssue and inClaim.IsExposure and Not UserAccess.ExposureAccess — the health-issue flag is gated on the exposure resource and the claim also being an exposure claim; the CollateralHealthClaim resource exposed by ClaimUserAccess.HealthIssueAccess is never consulted here (BR-CLM-009).
  4. m_SecureClaimAccess = False when inClaim.IsHostileWorker and Not UserAccess.SecureClaimAccess (BR-CLM-010).
  5. Delegated logic: each UserAccess.*Access property calls the inherited UserAccess.HasAccess(resourceName), which returns a cached decision or calls clsSecurityPrincipal.IsAuthorized(resourceName) and caches it per lower-cased name. Whether IsAuthorized performs an AD lookup or a WCF SecurityService call is implemented in SAIF.BOF.Framework.**

    Origin: The AD-membership resolution behind each UserAccess.*Access property is implemented in SAIF.Application (UserAccess.HasAccess) and SAIF.BOF.Framework.Security (clsSecurityPrincipal.IsAuthorized), and executed on behalf of this operation.

Process flow

The following diagram visualizes this operation's control flow.

flowchart TD
    Start([CheckClaim called]) --> Reset[Reset all four flags to True]
    Reset --> Conflict{"IsWorkerConflict and not<br>ConflictAccess?"}
    Conflict -->|Yes| DenyConflict[ConflictAccess = False]
    Conflict -->|No| Exposure{"IsExposure and not<br>ExposureAccess?"}
    DenyConflict --> Exposure
    Exposure -->|Yes| DenyExposure[ExposureAccess = False]
    Exposure -->|No| Health{"IsHealthIssue and IsExposure<br>and not ExposureAccess?"}
    DenyExposure --> Health
    Health -->|Yes| DenyHealth[HealthIssueAccess = False]
    Health -->|No| Hostile{"IsHostileWorker and not<br>SecureClaimAccess?"}
    DenyHealth --> Hostile
    Hostile -->|Yes| DenySecure[SecureClaimAccess = False]
    Hostile -->|No| Done([Return four flags])
    DenySecure --> Done

Failure and edge-case behavior

  • A claim whose sensitivity flags are all false is fully accessible to any authenticated user (fail-open default).
  • The CollateralHealthClaim AD resource, exposed via ClaimUserAccess.HealthIssueAccess, is never consulted by this operation; whether this is intentional narrowing or a defect is unknown.**

Note: Statements marked with * were inferred from code structure, naming conventions, or contextual evidence where direct confirmation was not available in source artifacts. Statements marked with ** could not be confirmed; treat as unknown until verified.

Sources

  • SAIF.Application.Claim/ClaimSecurity.vb
  • SAIF.Application.Claim/ClaimUserAccess.vb