---
title: Dependencies
summary: Internal libraries, external packages, framework components, consumed services, and database connections.
status: draft
owner: Not determined from source
last_reviewed: 2026-09-22
---

# Dependencies

`ADUserServices` is a single-project repository with zero `<ProjectReference>` elements, so it has no in-repository library dependencies. It consumes exactly one internal NuGet package (`SAIF.BOF.Framework`, for a single configuration-retrieval call), the ASMX/`System.DirectoryServices` framework surface it is built on, and eight further NuGet packages that are referenced in `packages.config` but exercise no symbol anywhere in source. It calls no downstream SOAP service, opens no database connection, and vendors no binary. Its technology classification is `bof`, decided decisively by the `SAIF.BOF.Framework` package match in `packages.config`, which outranks the coincidental `SAIF.Framework.*` reference pattern also present.

## Internal dependencies

| Dependency | Reference Type | Project path | Usage |
| --- | --- | --- | --- |
| `SAIF.BOF.Framework` 1.0.21273.5 (`SAIF.Framework.dll`) | NuGet Package | `packages\SAIF.BOF.Framework.1.0.21273.5\lib\net461\SAIF.Framework.dll` | Supplies `SAIF.Framework.Security.WebEnvironmentService`, constructed as `New WebEnvironmentService("aduserservices")` and read via `.GetConfigSetting("aduserservices.allowedips")` in `GetAllowedIPs` |
| `SAIF.BOF.Framework` 1.0.21273.5 (`SAIF.Framework.Preferences.dll`) | NuGet Package | `packages\SAIF.BOF.Framework.1.0.21273.5\lib\net461\SAIF.Framework.Preferences.dll` | Referenced only — no symbol from this assembly appears in source |

No `<ProjectReference>` exists anywhere in `ADUserServices.vbproj` — the solution contains exactly one code project, so there is no same-repository Project Reference dependency to record.

## External dependencies

| Dependency | Version | Usage |
| --- | --- | --- |
| `System.Web.Services` | framework (net462) | ASMX web service base class (`Inherits System.Web.Services.WebService`), `<WebMethod()>` attribute, and SOAP serialization for all 19 operations |
| `System.Web` | framework (net462) | ASP.NET hosting and request access — `HttpContext.Current.Request`, `.ServerVariables`, `.IsLocal` |
| `System.DirectoryServices` | framework (net462) | `DirectoryEntry`, `PropertyValueCollection`, `.CommitChanges()`, and property/method access via `DirectoryEntry.Properties("company")`, `Properties("telephoneNumber")`, `Properties("mail")`, `Properties("info")`, `Properties("title")`, `Properties("facsimileTelephoneNumber")`, `Properties("division")`, `Properties("lastLogonTimestamp")`, plus `Invoke("Remove", New Object() {deUser.Path})` (group-member removal) and `Invoke("SetPassword", oPassword)` (password reset) — the late-bound directory-write path used throughout |
| `System.DirectoryServices.AccountManagement` | framework (net462) | `PrincipalContext`, `UserPrincipal`, `GroupPrincipal`, `PrincipalSearcher`, `PrincipalCollection`, `Principal`, `ContextType` — the principal-level directory API |
| `SAIF.Framework.Common` | 1.0.15110.3 | Referenced only — no symbol used anywhere in source (unused, see [Tech debt](tech-debt.md) TD-08) |
| `SAIF.HashUtil` | 1.0.17332.6 | Referenced only — no `GetSecureConfigSetting`/`SystemHashUtil` call exists; unused (TD-08) |
| `SAIF.Web.API.Clients` | 1.0.17018.1 (`SAIF.Web.API.Clients.dll`, `SAIF.Web.API.Core.dll`) | Referenced only — no `JsonHttpClient`/`ClientInfo`/`RestClient` usage; unused (TD-08) |
| `Autofac` | 3.5.2 | Referenced only — no composition root exists anywhere in source; unused (TD-08) |
| `FluentValidation` | 5.5.0.0 | Referenced only — unused (TD-08) |
| `log4net` | 2.0.5 | Referenced only — never initialized or called; unused (TD-08, also SEC-09 — no audit logging exists) |
| `Newtonsoft.Json` | 8.0.3 | Referenced only — unused (TD-08) |
| `RestSharp` | 105.2.3 | Referenced only — unused (TD-08) |
| `System.Data`, `System.Data.DataSetExtensions`, `System.Web.Entity`, `System.Web.DynamicData`, `System.Drawing`, `System.Web.ApplicationServices`, `System.Web.Extensions`, `System.EnterpriseServices`, `System.Configuration`, `System.Xml` (duplicate), `System.Xml.Linq` | framework | Web-project template default `<Reference>` elements and imports; none is used in source (TD-15, LOW) |

## Transitive dependencies

Dependencies in this section are inherited from framework packages and are not referenced directly by this service, but are required at runtime.

| Dependency | Source framework | Type | Usage |
| --- | --- | --- | --- |
| `WebEnvironmentService` configuration-retrieval behavior | `SAIF.BOF.Framework` | Transitive | Internal to `SAIF.Framework.dll`; not re-derived in this analysis run, no Legends CLI/RAG query was issued, so no statement carries a `†` marker |

## Service dependencies

No downstream SOAP proxy or LDAP-fronting service is consumed by this service beyond Active Directory itself. No `Service References\`/`Web References\` folder, no `Reference.vb`/`.wsdl`/`.svcinfo`/`.svcmap`/`.disco` file, no `ChannelFactory`, and no `<system.serviceModel>` exists anywhere in the repository. This section is omitted from further detail because there are no rows to report.

## Database connections

No database connection exists. `<connectionStrings/>` in `Web.config` is empty, and no SQL, ORM, or BOF data-access construct of any kind appears in source. The service's only backing store is Active Directory, reached through `System.DirectoryServices`/`System.DirectoryServices.AccountManagement` against the domains and containers documented in [Configuration](configuration.md) — that store belongs to configuration, not to a database connection, and is not restated here.

## Dependency risks and notes
- **Unused package surface (TD-08, MEDIUM).** Eight referenced NuGet packages — `Autofac`, `FluentValidation`, `log4net`, `Newtonsoft.Json`, `RestSharp`, `SAIF.HashUtil`, `SAIF.Web.API.Clients`, `SAIF.Framework.Common` — plus `SAIF.Framework.Preferences.dll` exercise zero symbols anywhere in source. Each represents dependency surface (transitive vulnerability exposure, restore weight) with no corresponding benefit.
- **Unused framework references (TD-15, LOW).** A block of web-project template default references (`System.Data`, `System.Data.DataSetExtensions`, `System.Web.Entity`, `System.Web.DynamicData`, `System.Drawing`, `System.Web.ApplicationServices`, `System.Web.Extensions`, `System.EnterpriseServices`, `System.Configuration`, a duplicate `System.Xml`, `System.Xml.Linq`) is carried but not used.
- **Classic `packages.config`, no `PackageReference` migration path.** The project uses `packages.config` with assembly `<Reference>` hint paths into `packages\`; there is no `PackageReference`-style manifest and no migration in progress.
- **Technology classification: `bof`**, decided decisively from a direct read of `packages.config` and `ADUserServices.vbproj`: the `*.BOF.*` pattern (`SAIF.BOF.Framework`) matches and takes priority over the `SAIF.Framework.*` pattern (also present via `SAIF.Framework.Common` and the `SAIF.Framework`/`SAIF.Framework.Preferences` assembly references, which resolve inside the same `SAIF.BOF.Framework` package). `saif-bof-data-access` was deliberately not loaded despite the `bof` verdict: the package is used only for `WebEnvironmentService` configuration retrieval, with no `clsBusinessBase`, `IBusinessCriteria`, or data access of any kind for that skill to describe.
- **No vendored assemblies.** Every binary dependency resolves through `packages\`, a NuGet reference, or the framework/GAC; no `<Reference>` carries a `HintPath` outside `packages\`.

## Related documentation
- [Service index](index.md)
- [Overview](overview.md)
- [Architecture](architecture.md)
- [Activation and hosting](activation-hosting.md)
- [Operations](operations.md)
- [Operations and processes](operations-processes.md)
- [Authentication and authorization](authentication-authorization.md)
- [Business rules](business-rules.md)
- [Configuration](configuration.md)
- [Faults and error pipeline](faults.md)
- [Operational runbook](operational-runbook.md)
- [Tech debt](tech-debt.md)

> **Note:** Statements marked with * were inferred from code structure, naming conventions, or
> contextual evidence where direct confirmation was not available in source artifacts. Statements
> marked with ** could not be confirmed; treat as unknown until verified.

## Sources
- `src\ADUserServices\ADUserServices.vbproj`
- `src\ADUserServices\packages.config`
- `src\ADUserServices\clsADUserServices.asmx.vb`
- `.saifdocgen\state\runs\20260922-101326-aduserservices\analysis\aduserservices-analysis.md`