---
title: Authentication and authorization
summary: Identity, authorization enforcement, and access requirements for SAIF.Services.WCF.UC4.Host operations.
status: draft
owner: SAIF Doc Gen
last_reviewed: 2026-09-22
---

# Authentication and authorization

No operation on this host carries an authorization attribute or a programmatic identity check. Both Windows and anonymous authentication are enabled at the IIS layer, and the only gate on any request is a job-name allow/deny list, which is a *job* filter, not a *caller* filter.

## Authentication mechanism

Authentication is configured at the IIS layer by the release pipeline, not in code:

| Deployment setting | Value | Source |
| --- | --- | --- |
| `IISWindowsAuth` | `true` | `pipelines/build-vars.UC4.yml` |
| `IISAnonymousAuth` | `true` | `pipelines/build-vars.UC4.yml` |
| `IISAppPoolPipelineMode` | `Integrated` | `pipelines/build-vars.UC4.yml` |
| Applied by | `Stages/v2/deploy-stages-api-iis.yml@templates` with `IISWindowsAuth` / `IISAnonymousAuth` parameters | `pipelines/release.UC4.yml` |
| `system.webServer/security/authentication` in `Web.config` | Not declared | `src/WCF/SAIF.Services.WCF.UC4.Host/Web.config` |

**Both Windows and anonymous authentication are enabled on the deployed application**, and the same values are used for every stage the release template drives (the template defines the stage list outside this repository).

## Authorization enforcement points

Detection performed across `src/WCF/SAIF.Services.WCF.UC4.Host/*.cs` and `Web.config`, each returning no match: `[PrincipalPermission`, `ServiceAuthorizationManager`, `ServiceSecurityContext`, `OperationContext.Current.ServiceSecurityContext`, `[SaifAuthorize`, `IsAuthorized`, `<serviceAuthorization>`, `<serviceCredentials>`. There is no caller identity check, no role check, and no principal inspection anywhere in this host.

## Access requirements per operation

| Operation | Check found | Enforcement point |
| --- | --- | --- |
| [`ExecuteJob`](operations/execute-job.md) | None in code | — |
| [`ExecuteJobWithClientId`](operations/execute-job-with-client-id.md) | None in code | — |
| [`ExecuteJobWithJson`](operations/execute-job-with-json.md) | None in code | — |
| [`ExecuteJobWithJsonAndClientId`](operations/execute-job-with-json-and-client-id.md) | None in code | — |
| [`ExecuteJobWithValues`](operations/execute-job-with-values.md) | None in code | — |
| [`ExecuteJobWithValuesAndClientId`](operations/execute-job-with-values-and-client-id.md) | None in code | — |
| [`ExecuteJobWithParameters`](operations/execute-job-with-parameters.md) | None in code | — |
| [`ExecuteJobWithParametersAndClientId`](operations/execute-job-with-parameters-and-client-id.md) | None in code | — |

## Roles and resources

No role or resource model exists in this host. The nearest thing to an access-control resource is the `uc4.rules` environment-service document, which gates which **jobs** may run per environment — see [BR-UC4-001](business-rules.md#br-uc4-001-job-allowed-by-uc4-rules-document), [BR-UC4-002](business-rules.md#br-uc4-002-default-allow-for-unmatched-environment), and [BR-UC4-003](business-rules.md#br-uc4-003-rule-evaluation-order-and-match-type). It never inspects who is calling.

With anonymous authentication enabled and no authorization check in code, the effective access control for every operation is network reachability plus the `uc4.rules` allow/deny list — a *job* filter, never a *caller* filter.

## Secrets handling

| Aspect | Finding |
| --- | --- |
| Secrets referenced in code | None found — no `GetSecureConfigSetting` call exists in this host's source |
| Certificates | `Uc4Client.cs` imports `System.Security.Cryptography.X509Certificates` (line 7) but uses no certificate type anywhere — an unused import, not a security mechanism |
| Credentials transcribed in this documentation | None — no secret value is ever reproduced; only setting names and kinds are named |

## Security rules and provider/consumer relationship

The centralized SAIF WCF security service — `SecurityService`, `AuthorizationCacheService`, `ADService`, the provider side of the `IsAuthorized` / `IsAuthorized2` calls documented from the consumer side elsewhere in this repository — lives in the **sibling** host `SAIF.Services.WCF.Host` (route `Security`). **This host neither provides nor consumes it.** No `SecurityService`, `IsAuthorized`, or `securityServiceUrl` reference exists anywhere in `src/WCF/SAIF.Services.WCF.UC4.Host`. A reader who has seen the consumer-side documentation for other hosts must not expect that mechanism here: this host is outside the SAIF role model entirely.

The absence of authorization here is recorded as security finding F-SEC-001 (arbitrary job invocation across a network boundary with no caller authorization) — see [Tech debt](tech-debt.md) for the full security finding catalog.

## Related documentation
- [Index](index.md)
- [Overview](overview.md)
- [Architecture](architecture.md)
- [Activation and hosting](activation-hosting.md)
- [Operations](operations.md)
- [Faults and error pipeline](faults.md)
- [Dependencies](dependencies.md)
- [Configuration](configuration.md)
- [Operations and processes](operations-processes.md)
- [Business rules](business-rules.md)
- [Operational runbook](operational-runbook.md)
- [Tech debt](tech-debt.md)

## Sources
- `src/WCF/SAIF.Services.WCF.UC4.Host/UC4Service.cs`
- `src/WCF/SAIF.Services.WCF.UC4.Host/Uc4Client.cs`
- `src/WCF/SAIF.Services.WCF.UC4.Host/Web.config`
- `pipelines/build-vars.UC4.yml`
- `pipelines/release.UC4.yml`