---
title: ADUserServices overview
summary: Purpose, business context, and capability summary for the ASMX web service.
status: draft
owner: Not determined from source
last_reviewed: 2026-09-22
---

# ADUserServices overview

ADUserServices is a single-class ASMX web service that provisions, unlocks, deletes, and modifies Active Directory user accounts in the external domain (`external.saif.com`), manages group membership there, and answers read-only queries about user attributes and group/resource membership in both the external domain and the internal domain (`corp.saif.com`).

## Project shape

| Aspect | Finding |
| --- | --- |
| Evidence this is a web service | `clsADUserServices.asmx` marker file (`src\ADUserServices\clsADUserServices.asmx`) |
| Project type GUIDs | `{349c5851-65df-11da-9384-00065b846f21}`, `{F184B08F-C81C-45F6-A57F-5ABD9991F28F}` (`src\ADUserServices\ADUserServices.vbproj`) |
| WebForms artifacts present | None — no `.aspx` or `.ascx` file exists anywhere in the project |
| Conclusion | Classic ASMX web service — not a WebForms application |

## Purpose
- Add, modify, unlock, and delete AD user accounts in the external domain, and add/remove those accounts from AD groups*, per the object description embedded in the codebehind's header comment (`clsADUserServices.asmx.vb`).
- Answer directory read queries (email, fax number, printer attribute, last logon, group and resource membership) for callers, spanning both the internal and external domains depending on the operation.
- Serve as the IP allow-list gate (`CheckAccess`) that the eight mutating operations consult before acting.

## Business context

The header comment in the codebehind states this object "provides maintenance to AD user accounts in the external domain from web calls," while AD maintenance for the internal domain is stated to be handled elsewhere ("managed in batch by clDirectoryEntry in SAIF.Business.Security") — a system outside this repository and not further described here. If this service were unavailable, callers would lose the ability to provision, unlock, or delete external-domain AD accounts, manage their group memberships, and query AD attributes over SOAP.

| Attribute | Value |
| --- | --- |
| Business domain | Active Directory user and group account maintenance (external domain) and directory attribute lookup (internal and external domains) |
| Owning team | Not determined from source |
| Data ownership | Active Directory user and group objects in `external.saif.com` (writes); read-only attribute and membership queries against `external.saif.com` and `corp.saif.com` |
| Criticality | Not determined from source |

## SOAP namespace

| Aspect | Finding |
| --- | --- |
| Declared namespace | `http://tempuri.org/` |
| Declared on | `ADUserServices.clsADUserServices` (`src\ADUserServices\clsADUserServices.asmx.vb:38`) |
| Default scaffolding value | Yes — matches the Visual Studio/framework default |
| Wire impact | The namespace qualifies every request and response element and every SOAP action (e.g. `http://tempuri.org/GetUserEmail`); changing it breaks every existing caller |

**This is a flagged, non-negotiable finding.** The service ships with the bare template default namespace rather than an organization- or service-specific value. Because the namespace still matches the unmodified default*, this deployed service shares it with every other unmodified-default ASMX service, creating collision risk if two such services are ever proxied into the same consumer project. See [Tech debt](tech-debt.md) (TD-01, HIGH).

## Capability summary

| Capability | Service class | Operations | Description |
| --- | --- | --- | --- |
| Account provisioning and lifecycle | `clsADUserServices` | [`AddUser`](contracts/clsaduserservices.md#adduser), [`DeleteUser`](contracts/clsaduserservices.md#deleteuser), [`UnlockAccount`](contracts/clsaduserservices.md#unlockaccount), [`ChangeUserAccount`](contracts/clsaduserservices.md#changeuseraccount) | Create, delete, unlock, and modify external-domain AD user accounts |
| Password management | `clsADUserServices` | [`ChangeUserPassword`](contracts/clsaduserservices.md#changeuserpassword), [`ChangeUserPasswordOrGetException`](contracts/clsaduserservices.md#changeuserpasswordorgetexception) | Reset an external-domain account password, with a sentinel-response variant and a faulting variant |
| Group membership management | `clsADUserServices` | [`AddUserToGroup`](contracts/clsaduserservices.md#addusertogroup), [`DeleteUserFromGroup`](contracts/clsaduserservices.md#deleteuserfromgroup) | Grant or revoke external-domain AD group membership |
| Directory attribute and membership queries | `clsADUserServices` | [`DoesUserExist`](contracts/clsaduserservices.md#doesuserexist), [`DoesUserHaveResource`](contracts/clsaduserservices.md#doesuserhaveresource), [`GetUserEmail`](contracts/clsaduserservices.md#getuseremail), [`GetUserGroups`](contracts/clsaduserservices.md#getusergroups), [`GetUserResources`](contracts/clsaduserservices.md#getuserresources), [`GetUserFAX`](contracts/clsaduserservices.md#getuserfax), [`GetUserLastLogon`](contracts/clsaduserservices.md#getuserlastlogon), [`GetUserPrinter`](contracts/clsaduserservices.md#getuserprinter), [`IsUserInGroup`](contracts/clsaduserservices.md#isuseringroup) | Read-only lookups of AD attributes and group/resource membership across the internal and external domains |
| Access control primitive | `clsADUserServices` | [`CheckAccess`](contracts/clsaduserservices.md#checkaccess) | Evaluates the caller's IP against the allow-list and reports the decision; also the gate consulted by the mutating operations |
| Contract scaffolding | `clsADUserServices` | [`HelloWorld`](contracts/clsaduserservices.md#helloworld) | Constant-string diagnostic operation left on the published contract |

## Message format

| Aspect | Finding |
| --- | --- |
| Message encoding | Protocol/binding availability is unknown — no `<protocols>` element is declared in `Web.config` and no WSDL is checked into the repository, so which SOAP binding is actually published is not evidenced and the ASMX/`SoapExtensionReflector` framework default applies** |
| Serializer | `XmlSerializer` (ASMX default) |
| Binding style | Document/Literal (ASMX default; no explicit `SoapDocumentMethod` overrides found) |
| WSI conformance | `WsiProfiles.BasicProfile1_1` |
| Metadata document | `clsADUserServices.asmx?wsdl` |
| Script-callable surface | Not applicable — `ScriptService` is commented out |

## Non-documented artifacts

- Visual Studio web-project template scaffolding — `My Project\Application.myapp`, `Application.Designer.vb`, `Resources.resx`/`Resources.Designer.vb`, `Settings.settings`/`Settings.Designer.vb`, `AssemblyInfo.vb`, and `My Project\MyExtensions\MyWebExtension.vb` (the generated, empty `MyWebServices` group) are generated designer files with no authored content and are excluded from this document set.

## Related documentation
- [Service index](index.md)
- [Architecture](architecture.md)
- [Activation and hosting](activation-hosting.md)
- [Operations](operations.md)
- [Faults and error pipeline](faults.md)
- [Authentication and authorization](authentication-authorization.md)
- [Dependencies](dependencies.md)
- [Configuration](configuration.md)
- [Operations and processes](operations-processes.md)
- [Business rules](business-rules.md)
- [Operational runbook](operational-runbook.md)
- [Tech debt](tech-debt.md)

> **Note:** Statements marked with * were inferred from code structure, naming conventions, or
> contextual evidence where direct confirmation was not available in source artifacts. Statements
> marked with ** could not be confirmed; treat as unknown until verified.

## Sources
- `src\ADUserServices\clsADUserServices.asmx.vb`
- `src\ADUserServices\clsADUserServices.asmx`
- `src\ADUserServices\ADUserServices.vbproj`
- `.saifdocgen\state\runs\20260922-101326-aduserservices\analysis\aduserservices-analysis.md`