---
title: SOAP service documentation
summary: Entry point for classic ASMX web service documentation.
status: draft
owner: Not determined from source
last_reviewed: 2026-09-22
---

# SOAP service documentation

ADUserServices is a single-class ASMX web service that provisions, unlocks, deletes, and modifies Active Directory user accounts in the external domain, manages group membership, and answers read-only queries about user attributes and group membership in both the internal and external domains. Consumers are not identifiable from this repository; the service publishes 19 operations behind an IP allow-list that gates 8 mutating operations.

| Field | Value |
| --- | --- |
| **Host project** | `ADUserServices` |
| **Framework** | ASMX (`System.Web.Services`, .NET Framework v4.6.2) |
| **Language** | VB.NET |
| **Host** | IIS — No `Global.asax` |
| **Activation** | `.asmx` marker file + codebehind |
| **Service classes** | 1 |
| **SOAP namespace** | `http://tempuri.org/` |
| **WSI conformance** | `<WebServiceBinding(ConformsTo:=WsiProfiles.BasicProfile1_1)>` |
| **Base class** | `System.Web.Services.WebService` |
| **ScriptService** | Commented out (not active) |
| **Metadata publication** | `?wsdl` published by ASP.NET |
| **Deployment variants** | Internal and External |

**Flagged finding — SOAP namespace.** `http://tempuri.org/` is the untouched Visual Studio/framework scaffolding default (`clsADUserServices.asmx.vb` line 38). It qualifies every request and response element and every SOAP action on the wire; it was never changed. See [Tech debt](tech-debt.md) (TD-01, HIGH).

## Documentation sections

| Section | Description |
| --- | --- |
| [Overview](overview.md) | Purpose, consumers, business context, and capability summary |
| [Architecture](architecture.md) | Layering, request path, shared state, and integration points |
| [Activation and hosting](activation-hosting.md) | `.asmx` inventory, codebehind mapping, and deployment variants |
| [Operations](operations.md) | Operation catalog with per-service detail pages |
| [Faults and error pipeline](faults.md) | `SoapException` behavior and what a caller receives |
| [Authentication and authorization](authentication-authorization.md) | Identity, authorization enforcement, and role requirements |
| [Dependencies](dependencies.md) | Libraries, packages, services, and database connections |
| [Configuration](configuration.md) | Configuration reads and the Web.config surface |
| [Operations and processes](operations-processes.md) | End-to-end processing workflows behind the operations |
| [Business rules](business-rules.md) | Rules enforced during message processing |
| [Operational runbook](operational-runbook.md) | Deployment, health checks, logs, faults, error recovery |
| [Tech debt](tech-debt.md) | CRITICAL and HIGH severity findings |

## Service classes

| Service class | `.asmx` file | SOAP namespace | Operations | Also hosted in | Documentation |
| --- | --- | --- | --- | --- | --- |
| `ADUserServices.clsADUserServices` | `clsADUserServices.asmx` | `http://tempuri.org/` | 19 | — | [Docs](contracts/clsaduserservices.md) |

## WebMethod catalog

| # | Operation | Purpose | Access check | Documentation |
| --- | --- | --- | --- | --- |
| OP-01 | `HelloWorld` | Constant greeting; scaffolding on the published contract | None | [Docs](contracts/clsaduserservices.md#helloworld) / [Operation](operations/hello-world.md) |
| OP-02 | `AddUser` | Creates an external-domain AD account | IP allow-list | [Docs](contracts/clsaduserservices.md#adduser) / [Operation](operations/add-user.md) |
| OP-03 | `UnlockAccount` | Unlocks an external-domain account | IP allow-list | [Docs](contracts/clsaduserservices.md#unlockaccount) / [Operation](operations/unlock-account.md) |
| OP-04 | `AddUserToGroup` | Grants group membership | IP allow-list | [Docs](contracts/clsaduserservices.md#addusertogroup) / [Operation](operations/add-user-to-group.md) |
| OP-05 | `DeleteUser` | Deletes an external-domain account | IP allow-list | [Docs](contracts/clsaduserservices.md#deleteuser) / [Operation](operations/delete-user.md) |
| OP-06 | `DeleteUserFromGroup` | Revokes group membership | IP allow-list | [Docs](contracts/clsaduserservices.md#deleteuserfromgroup) / [Operation](operations/delete-user-from-group.md) |
| OP-07 | `DoesUserExist` | Existence check, either domain | None | [Docs](contracts/clsaduserservices.md#doesuserexist) / [Operation](operations/does-user-exist.md) |
| OP-08 | `DoesUserHaveResource` | Transitive resource-membership check | None | [Docs](contracts/clsaduserservices.md#doesuserhaveresource) / [Operation](operations/does-user-have-resource.md) |
| OP-09 | `ChangeUserAccount` | Modifies account attributes | IP allow-list | [Docs](contracts/clsaduserservices.md#changeuseraccount) / [Operation](operations/change-user-account.md) |
| OP-10 | `ChangeUserPassword` | Resets password (sentinel on failure) | IP allow-list | [Docs](contracts/clsaduserservices.md#changeuserpassword) / [Operation](operations/change-user-password.md) |
| OP-11 | `ChangeUserPasswordOrGetException` | Resets password (faults on failure) | IP allow-list | [Docs](contracts/clsaduserservices.md#changeuserpasswordorgetexception) / [Operation](operations/change-user-password-or-get-exception.md) |
| OP-12 | `GetUserEmail` | Reads `mail` | None | [Docs](contracts/clsaduserservices.md#getuseremail) / [Operation](operations/get-user-email.md) |
| OP-13 | `GetUserGroups` | Reads transitive group list (untyped `ArrayList`) | None | [Docs](contracts/clsaduserservices.md#getusergroups) / [Operation](operations/get-user-groups.md) |
| OP-14 | `GetUserResources` | Reads filtered `*Resource*` groups (untyped `ArrayList`) | None | [Docs](contracts/clsaduserservices.md#getuserresources) / [Operation](operations/get-user-resources.md) |
| OP-15 | `GetUserFAX` | Reads `facsimileTelephoneNumber` | None | [Docs](contracts/clsaduserservices.md#getuserfax) / [Operation](operations/get-user-fax.md) |
| OP-16 | `GetUserLastLogon` | Reads/derives `lastLogonTimestamp` | None | [Docs](contracts/clsaduserservices.md#getuserlastlogon) / [Operation](operations/get-user-last-logon.md) |
| OP-17 | `GetUserPrinter` | Reads `extensionAttribute2`, internal domain only | None | [Docs](contracts/clsaduserservices.md#getuserprinter) / [Operation](operations/get-user-printer.md) |
| OP-18 | `IsUserInGroup` | Direct (non-transitive) membership check | None | [Docs](contracts/clsaduserservices.md#isuseringroup) / [Operation](operations/is-user-in-group.md) |
| OP-19 | `CheckAccess` | The IP allow-list decision itself, published and unauthenticated | None — is itself the access-control primitive | [Docs](contracts/clsaduserservices.md#checkaccess) / [Operation](operations/check-access.md) |

## Related documentation
- [Overview](overview.md)
- [Architecture](architecture.md)
- [Activation and hosting](activation-hosting.md)
- [Operations](operations.md)
- [Faults and error pipeline](faults.md)
- [Authentication and authorization](authentication-authorization.md)
- [Dependencies](dependencies.md)
- [Configuration](configuration.md)
- [Operations and processes](operations-processes.md)
- [Business rules](business-rules.md)
- [Operational runbook](operational-runbook.md)
- [Tech debt](tech-debt.md)

## Sources
- `src\ADUserServices\clsADUserServices.asmx`
- `src\ADUserServices\clsADUserServices.asmx.vb`
- `.saifdocgen\state\runs\20260922-101326-aduserservices\analysis\aduserservices-analysis.md`