Skip to content

Evaluate and cache AD resource access

Answers whether the current user holds a named Active Directory resource, checking a per-instance cache before delegating to the security principal.

Field Value
Operation ID evaluate-and-cache-ad-resource-access
Trigger A derived access class (e.g. ClaimUserAccess) is asked whether the current user holds a named AD resource
Inputs One or more AD resource names; a clsSecurityPrincipal previously supplied via SetPrincipal
Outputs Boolean authorization result; a populated per-instance cache
Primary components UserAccess.CheckAccess, UserAccess.HasAccess, UserAccess.SetPrincipal
Entry point SAIF.Application/UserAccess.vb

Steps

  1. A derived access class calls SetPrincipal(inPrincipal) to bind the identity; if this is skipped, HasAccess fails with a null-reference on the first uncached lookup.**
  2. HasAccess(inResourceName) lower-cases the resource name and probes m_AccessControl; a cache hit returns the stored Boolean immediately (BR-APP-004).
  3. A cache miss calls m_Principal.IsAuthorized(inResourceName) (the framework appends the environment suffix to the resource name), caches the result, and returns it.
  4. CheckAccess(ParamArray inResourceName()) loops the supplied names calling HasAccess on each purely to warm the cache; the loop variable is overwritten each iteration and then discarded, so the method returns no information to the caller.

Process flow

The following diagram visualizes this operation's control flow.

flowchart TD
    Start(["HasAccess<br>called"]) --> Bind["SetPrincipal bound<br>identity"]
    Bind --> Cache{"Cached?"}
    Cache -->|Yes| Return["Return cached<br>Boolean"]
    Cache -->|No| Query["m_Principal.IsAuthorized"]
    Query --> StoreCache["Cache result"]
    StoreCache --> Return

Failure and edge-case behavior

  • If SetPrincipal was never called, the first uncached lookup fails with a null-reference exception.**
  • CheckAccess warms the cache for multiple resource names but discards its own loop result, so it cannot be used to test a specific name's outcome.