Activation and hosting¶

ADUserServices publishes exactly one operation set through a single .asmx marker file, built and deployed by a single pipeline into two named deployment variants (Internal and External).

Activation mechanism¶

Aspect	Finding
Mechanism	`.asmx` marker file + codebehind
Marker files	1
Directive form	`<%@ WebService Language="vb" CodeBehind="clsADUserServices.asmx.vb" Class="ADUserServices.clsADUserServices" %>`
`<system.serviceModel>`	Not present
Address composition	Application base address + the marker file's path within the project

Marker file inventory¶

Marker file	Language	Codebehind	Class	Address suffix
`clsADUserServices.asmx`	`vb`	`clsADUserServices.asmx.vb`	`ADUserServices.clsADUserServices`	`/clsADUserServices.asmx`

Activation diagram¶

The following diagram visualizes how a request reaches an operation.

flowchart TD
    REQ["Caller request<br>/clsADUserServices.asmx"] --> IIS["IIS maps .asmx<br>to the ASP.NET handler"]
    IIS --> DIRECTIVE["WebService directive<br>names ADUserServices.clsADUserServices"]
    DIRECTIVE --> INST["clsADUserServices constructed<br>per request"]
    INST --> ACTION{"SOAP action"}
    ACTION -->|"one of 19 WebMethods"| WM["WebMethod invoked"]
    ACTION -->|"Unknown"| FAULT["SOAP fault"]
    WM --> RESP["Response message"]

Metadata and test surface¶

Aspect	Finding
WSDL document	`clsADUserServices.asmx?wsdl` (framework-generated; no WSDL is checked into the repository)
ASP.NET test page	Not determined from source — no `<protocols>` element appears in `Web.config`, so protocol availability sits at framework defaults
Documentation protocol	Not determined from source — same reason

No <protocols> element exists in Web.config, so whether SOAP 1.1, SOAP 1.2, or the ASMX built-in test-form protocol is published cannot be confirmed from this repository. See Tech debt for the related finding on the untouched scaffolding defaults elsewhere in this service.

Host inventory¶

This repository contains exactly one deployable project — ADUserServices — which hosts the one service documented in this set. No second project, host, or embedded library exists in the repository.

Deployment variants¶

Two build artifact variants are declared by pipelines\build-vars.yml, both deployed by pipelines\release.yml through /Stages/v2/deploy-stages-web-iis-webservices.yml@templates.

Variant	Build configuration	Artifact	Config transform	Audience	Notes
Internal	`Release`	`app-internal` (`ArtifactNameInternal`)	`Web.Release.config`	Not determined from source	IIS anonymous authentication enabled (`IISAnonymousAuthInternal: true`)
External	`Release`	`app-internal` (`ArtifactNameExternal`)	`Web.Release.config`	Not determined from source	IIS anonymous authentication enabled (`IISAnonymousAuthExternal: true`)

ArtifactNameExternal is set to the same literal value as ArtifactNameInternal — app-internal — in pipelines\build-vars.yml. Both variants are declared to build the same artifact name despite being intended as separate deployment surfaces. This is tech-debt item TD-27 (HIGH); see Tech debt for the full finding.

Variant differences¶

Setting or behavior	Internal	External	Source
`ArtifactName*`	`app-internal`	`app-internal` (collision — see TD-27)	`pipelines\build-vars.yml`
`IISAnonymousAuth*`	`true`	`true`	`pipelines\release.yml`
Services exposed	All 19 operations	All 19 operations	`src\ADUserServices\clsADUserServices.asmx.vb` (single class, single marker file — no per-variant conditional compilation found)

IIS configuration¶

Aspect	Finding
Site / virtual directory	Not determined from source — `<IISUrl>` is empty and `<UseIIS>False</UseIIS>` in `ADUserServices.vbproj`
Application pool	Not determined from source
Platform target	Not determined from source
`httpErrors` mode	Not declared
Custom modules or handlers	None — `Web.config` declares no `<configSections>` and no custom `<httpModules>`/`<httpHandlers>` entries beyond ASP.NET/ASMX defaults

Flagged finding — SOAP namespace tied to hosting. The service's published contract carries the untouched framework default namespace http://tempuri.org/ (clsADUserServices.asmx.vb line 38). Because the deployed host, site, and virtual path are themselves not determinable from source, the concrete WSDL address a consumer would target cannot be composed from this repository either. Both facts are recorded together here because they compound: an unknown address serving an unremarkable default namespace gives a reader no way to distinguish this endpoint from another default-namespace ASMX service without out-of-band deployment knowledge. See Tech debt (TD-01, HIGH) and Authentication and authorization for the IIS anonymous-authentication finding (SEC-01).

Authentication is declared as Windows in Web.config with no <authorization> element, while both deployment variants enable IIS anonymous authentication in pipelines\release.yml. Full detail, including the security implications, is documented in Authentication and authorization.

Sources¶

src\ADUserServices\clsADUserServices.asmx
src\ADUserServices\clsADUserServices.asmx.vb
src\ADUserServices\ADUserServices.vbproj
src\ADUserServices\Web.config
pipelines\build-vars.yml
pipelines\release.yml
.saifdocgen\state\runs\20260922-101326-aduserservices\analysis\aduserservices-analysis.md