ADUserServices deploys to IIS through the SAIF web-IIS deployment template in two build variants that are materially identical in this repository — same Release configuration, same artifact name, same anonymous-authentication setting, and the same Web.Release.config transform. Concrete site, virtual-directory, and application-pool details are owned by the external deploy template and are not present in this repository. The service holds no process-wide state, so there is nothing to reset on an application-pool recycle, and it emits no logs of any kind.
Each track carries one allowedips address in environmentsettings\settings.yml
Production
Internal / External (materially identical)
<host>/<virtual-directory>/clsADUserServices.asmx — host and virtual directory not determined from source
prod
Carries four allowedips addresses
The two build variants (Internal/External) are not distinct deployment environments in this repository — they differ only in artifact-naming intent (both currently resolve to app-internal, see TD-27) and neither transforms a different configuration value.
Constant string "Hello World" returned; no side effects, no shared state, no directory access
HelloWorld is the lightest available read — it takes no parameters, performs no directory lookup, and cannot fail. No dedicated health endpoint exists in this service; none is invented here.
No log4net initialization or call, no Trace.WriteLine, no EventLog write, and no StreamWriter exists anywhere in source, despite the log4net 2.0.5 package reference being present in packages.config. This is a negative finding recorded explicitly: there is no logging destination to configure, monitor, or rotate for this service, and no mutating operation (account creation, deletion, password reset, group change) leaves any application-level record of who performed it.
aduserservices.allowedips setting missing for a track
SoapException on every gated operation for that track
All 8 mutating operations fail; the 11 read operations are unaffected
Provision the setting in environmentsettings\settings.yml for the affected track
Environment service unreachable
SoapException propagated out of CheckAccess
All 8 mutating operations fail; reads continue serving directory data
Verify SAIF environment-service availability
Active Directory unavailable
Sentinel (UserDoesNotExist/GroupDoesNotExist/False/empty list) for most operations, or a SoapException from the handful of operations with no Try/Catch (DoesUserHaveResource, CheckAccess)
Directory-dependent operations degrade; the failure detail is not surfaced to the caller
Verify the configured directory domains (external.saif.com, corp.saif.com) and connectivity
Log directory unavailable
Not applicable — no logging surface exists
Not applicable
Not applicable
Application pool recycled under load
No impact — no process-wide cache, counter, or shared state exists in this service (see Architecture)
None
None required
Stale cached data served
Not applicable — no cache exists
Not applicable
Not applicable
Hard-coded default password in effect for accounts created with an empty inPassword
Newly-created accounts share a single known credential
Any holder of that credential can authenticate as any account created without an explicit password
Always supply an explicit inPassword; remediate per Tech debt (SEC-05, CRITICAL)
No telemetry, fault-rate alert, or availability probe is configured anywhere in this repository. This is stated plainly rather than describing a hypothetical alert.
Note: Statements marked with * were inferred from code structure, naming conventions, or
contextual evidence where direct confirmation was not available in source artifacts. Statements
marked with ** could not be confirmed; treat as unknown until verified.