SAIF.Application security and authorization¶

This page documents authorization mechanisms implemented or consumed by this library. Authentication is handled entirely by infrastructure (NTLM/AD) and is not application-level — all code receives a WindowsIdentity-backed clsSecurityPrincipal on the request context, and no authentication code exists in this library.

Authorization architecture¶

SAIF.Application is a delegated / pass-through authorization layer: it caches and exposes decisions produced by the BOF framework's clsSecurityPrincipal.IsAuthorized, and performs no AD, LDAP, or WCF call itself. The library declares zero AD resource names — resource names travel in as method parameters (UserAccess.HasAccess(inResourceName), UserAccess.CheckAccess(ParamArray inResourceName())) and are forwarded verbatim to the framework principal, so this library supplies the mechanism (identity binding, decision caching, tri-state access classification, deny-by-default) but no policy.

flowchart TD
    Deriv["Derived manager / access<br>class"] --> UA[UserAccess.HasAccess]
    UA --> Cache{Cached?}
    Cache -->|Yes| Return[Return cached Boolean]
    Cache -->|No| SP[clsSecurityPrincipal.IsAuthorized]
    SP --> AD[(AD group check<br>implementation opaque)]
    AD --> Return

Whether clsSecurityPrincipal.IsAuthorized internally performs a WCF SecurityService hop, a direct AD lookup, or a process-level cached lookup cannot be confirmed from this repository — the implementation lives in the external SAIF.BOF.Framework 2.0.22279.1 package, which is not available locally.**

AD resource catalog¶

None. SAIF.Application declares zero AD resource names. Every source file was scanned for resource-name string literals, *SECURITYKEY / *Resource constants, LDAP paths, and attribute parameters; no match exists.

Resource name	Purpose	Enforcement point	Source
— (none declared)	—	—	—

Resource names that flow through this library are declared by consumers in the same repository and belong to their own libraries' documentation, not to SAIF.Application: SecureClaim, ConflictClaim, ExposureClaim, CollateralHealthClaim (SAIF.Application.Claim/ClaimUserAccess.vb); LNConflict, LNExposure, LNAdmin, LNCaseUpdate, LNView (SAIF.Application.Claim.Legal/LegalManagerBase.vb); LNNoteView, LNUpdate (SAIF.Application.Claim.Legal/LegalNet/clsCaseNotesManager.vb); LNLCEUpdate, LNDueDateUpdate (SAIF.Application.Claim.Legal/LegalNet/clsScheduleManager.vb).

Authorization enforcement points¶

Attribute-based authorization¶

None. No <SAIFAuthorize>, <SaifAuthorize>, <Authorize>, or any type inheriting AuthorizeAttribute appears in SAIF.Application; the library is a non-web class library.

Programmatic authorization checks¶

Class	Method	Resource / Role	Check type	Source
`UserAccess`	`HasAccess(inResourceName As String) As Boolean`	caller-supplied resource name	Decision point — cache probe on `m_AccessControl(inResourceName.ToLower)`; on miss calls `m_Principal.IsAuthorized(inResourceName)` and caches the Boolean. The only call site in the library that actually asks for an authorization decision.	`SAIF.Application/UserAccess.vb`
`UserAccess`	`CheckAccess(ParamArray inResourceName As String())`	caller-supplied resource names	Cache warm-up — loops the names calling `HasAccess`; the loop result is discarded, so nothing is returned to the caller and no denial is raised.	`SAIF.Application/UserAccess.vb`
`UserAccess`	`SetPrincipal(inPrincipal As clsSecurityPrincipal)` (`Protected`)	—	Identity binding — injects the principal whose authorizations are evaluated. `m_Principal` has no default; calling `HasAccess` before `SetPrincipal` throws `NullReferenceException` (fail-closed by exception, not by explicit denial).	`SAIF.Application/UserAccess.vb`
`AppManagerBase`	`New(inSecurityPrincipal As clsSecurityPrincipal)` (`Protected`, only constructor)	—	Identity binding / precondition — no manager instance can exist without an identity (BR-APP-001).	`SAIF.Application/AppManagerBase.vb`
`AppManagerBase`	`OnCheckSecurity()` (`Protected MustOverride`)	—	Enforcement hook — the contractual place where a derived manager translates resource access into an `AppSecurityRole`. Declared but never invoked from within this library; invocation is the derived manager's responsibility.	`SAIF.Application/AppManagerBase.vb`
`AppManagerBase`	`MarkUpdate()` / `MarkViewOnly()` / `MarkNoAccess()` (`Protected`)	—	Decision recording — the only writers of `m_AppSecurityRole`. `SecurityRole` and the derived `Is*` properties are read-only, so no external caller can elevate its own rights (BR-APP-003).	`SAIF.Application/AppManagerBase.vb`

Count: 6 programmatic enforcement points, 0 attribute-based.

Data-level authorization¶

None found in this library. No CheckValidContext, IsValidPolicyForCurrentUser, ValidateOwnership, IsExternal, or equivalent ownership-validation member exists. ApplicationDataAccess only builds connection environments and data portals; it issues no query and applies no row filter. AppManagerBase.ValidContext / OnValidContext() is the declared hook for context validation — it is MustOverride and never called from within this library, so any ownership check it eventually performs is authored by the derived manager.

Security-adjacent (audit, not authorization): the database client identity is derived from the authenticated user — AppManagerBase.DataLayer lazily constructs New ApplicationDataAccess(SecurityPrincipal.UserName.ToString), and ApplicationDataAccess.New sets m_Env.ClientID = inBatchUserID when a non-empty id is supplied. CreateSQLServerPortal / CreateOraclePortal override ClientID with BatchID when non-blank (BR-APP-007). This is an attribution/traceability control, not an access-control check — nothing is denied on its basis. The BatchID property is Public read/write with no guard, so a caller can freely change the DB client identity; this is impersonation-for-auditing only and does not affect AD authorization.

Segregation of duties¶

None found. No *SegregationOfDuties* / *SOD* type or member exists in SAIF.Application. The only mutual exclusivity present is the AppSecurityRole tri-state (BR-APP-003), which is an access-classification invariant, not a segregation-of-duties control.

Security interfaces and contracts¶

Interface / Class	Role	Consumers	Source
`clsSecurityPrincipal`	External authorization decision source (namespace `SAIF.Framework.Security`, package `SAIF.BOF.Framework` 2.0.22279.1)	`UserAccess`, `AppManagerBase.SecurityPrincipal`	`SAIF.Application/UserAccess.vb`, `SAIF.Application/AppManagerBase.vb`
`UserAccess`	Authorization-decision cache boundary consumed by domain access classes	`SAIF.Application.Claim/ClaimUserAccess.vb` (`Inherits UserAccess`)	`SAIF.Application/UserAccess.vb`
`AppManagerBase`	Security-aware manager base exposing `SecurityPrincipal` (`Protected ReadOnly`) to derived managers only	`SAIF.Application.Claim/ClaimAppManager.vb`, `SAIF.Application.Claim.Legal/LegalManagerBase.vb`	`SAIF.Application/AppManagerBase.vb`

Security architecture summary¶

Metric	Value
Authorization architecture type	Delegated / pass-through
Total AD resource names referenced	0
Authorization enforcement points — attribute-based	0
Authorization enforcement points — programmatic	6
Data-level (ownership) authorization checks	0
Segregation of duties (SOD) rules	0
Machine/application authorization present	No
Security manager implementations	0 (no `ISecurityManager`, `IDomainSecurityManager`, `SecurityManager`, `DomainSecurityManagerBase`)
Directory-services usage	None (no `System.DirectoryServices`, `PrincipalContext`, `GroupPrincipal`, `DirectoryEntry`, `DirectorySearcher`, or LDAP literal)
Security types consumed	`clsSecurityPrincipal` (`SAIF.Framework.Security`, package `SAIF.BOF.Framework` 2.0.22279.1), imported project-wide via `<Import Include="SAIF.Framework.Security" />`
Caching model	Per-`UserAccess`-instance `SortedList(Of String, Boolean)` keyed on the lower-cased resource name; a mid-session AD group change is not observed until a new instance is created (BR-APP-004)
Default posture	Deny by default (`NoAccess` initial state; empty cache forces a real `IsAuthorized` call on first ask)
WCF SecurityService integration	None in this library — no service reference, endpoint URL, or `IsAuthorized2` call; any WCF hop occurs inside `clsSecurityPrincipal.IsAuthorized`.**

Coverage assessment. SAIF.Application supplies the mechanism (identity binding, decision caching, tri-state access classification, deny-by-default) but contains no policy. All policy — which resource guards which capability — is expressed one layer up, in SAIF.Application.Claim and SAIF.Application.Claim.Legal.

Note: Statements marked with * were inferred from code structure, naming conventions, or contextual evidence where direct confirmation was not available in source artifacts. Statements marked with ** could not be confirmed; treat as unknown until verified.

Sources¶

SAIF.Application/UserAccess.vb
SAIF.Application/AppManagerBase.vb
SAIF.Application/Enums.vb
SAIF.Application/ApplicationDataAccess.vb
SAIF.Application/SAIF.Application.vbproj
SAIF.Application.Claim/ClaimUserAccess.vb
SAIF.Application.Claim.Legal/LegalManagerBase.vb
SAIF.Application.Claim.Legal/LegalNet/clsCaseNotesManager.vb
SAIF.Application.Claim.Legal/LegalNet/clsScheduleManager.vb