Operations¶

This host publishes exactly one ASMX service class, ADUserServices.clsADUserServices, exposing 19 <WebMethod()> operations for Active Directory user, group, and access-control maintenance across the internal (corp.saif.com) and external (external.saif.com) domains. There is no dispatcher, handler, or delegation layer: each operation is a direct method on the codebehind class, and no operation name is ever overridden — every wire operation name equals its VB method name.

This page is the operation catalog and hub. Each service class's operations are documented in detail on its own page under contracts/.

Operation surface derivation¶

Aspect	Finding
Authoritative surface	`<WebMethod()>` members on `ADUserServices.clsADUserServices`
SOAP namespace	`http://tempuri.org/` (`clsADUserServices.asmx.vb` line 38 — `<System.Web.Services.WebService(Namespace:="http://tempuri.org/")>`)
Operation naming	Method name — no `WebMethod(MessageName:="<name>")` override appears anywhere in the file
Binding conformance	`WsiProfiles.BasicProfile1_1` (`clsADUserServices.asmx.vb` line 39 — `<System.Web.Services.WebServiceBinding(ConformsTo:=WsiProfiles.BasicProfile1_1)>`)
Metadata document	Framework-generated, retrievable at `<service-address>?WSDL`; no WSDL is checked into the repository

Contract-stability finding. The SOAP namespace is the untouched Visual Studio/framework template default, never changed to an organization- or service-specific value. This is a HIGH-severity contract-stability finding — see tech-debt.md TD-01 — because the WSDL target namespace, every message's XML namespace, and every operation's SOAP action all derive from this value, and it is shared with every other unmodified ASMX service. Do not normalize or "correct" this value anywhere in this document set; it is reported exactly as written in source. The SOAP action pattern is <namespace><OperationName>, e.g. http://tempuri.org/GetUserEmail. The deployed host or virtual path is not determinable from the repository — <IISUrl> is empty and <UseIIS>False</UseIIS> in ADUserServices.vbproj*.

ScriptService is commented out and inactive — line 37 reads ' <System.Web.Script.Services.ScriptService()> _, a VB.NET line comment, not a live attribute. There is no JSON/AJAX-callable surface and no system.web.extensions registration anywhere in Web.config. Every one of the 19 <WebMethod()> occurrences is the bare attribute with no arguments — no MessageName, Description, EnableSession, CacheDuration, BufferResponse, or TransactionOption is supplied anywhere. Consequences of this bare usage: EnableSession defaults to False (the inherited Session property is not session-backed for any operation), CacheDuration defaults to 0 (no framework response caching), and there is no authored Description text carried into the WSDL — every operation summary in this document set is derived from the implementation.

WS-I Basic Profile 1.1 is a declaration, not a fully enforced constraint: two constructs on this contract sit uncomfortably with it — the untyped ArrayList returns on GetUserGroups/GetUserResources, which serialize as unconstrained xsd:anyType arrays (see tech-debt.md TD-05), and the ADServiceResponse/HasAccessResponse message types, whose public fields (not properties) form the message body. EmitConformanceClaims is not supplied on the WebServiceBinding attribute, so the framework default False applies and no conformance claim is emitted into the generated WSDL. The base class is System.Web.Services.WebService (clsADUserServices.asmx.vb line 42).

Service class catalog¶

Service class	`.asmx` file	SOAP namespace	Operations	Documentation
`ADUserServices.clsADUserServices`	`clsADUserServices.asmx`	`http://tempuri.org/`	19	Details

The marker file is src\ADUserServices\clsADUserServices.asmx; the codebehind is src\ADUserServices\clsADUserServices.asmx.vb.

Operation catalog¶

19 <WebMethod()> members compose the operation surface. Eight are gated by the application-layer IP allow-list (CheckAccess().HasAccess); eleven have no access check at all — see authentication-authorization.md.

Operation	Service class	Input message	Output message	Faults	Auth	Rules
`HelloWorld`	`clsADUserServices`	None	`String`	None declared — cannot fail	None in code	—
`AddUser`	`clsADUserServices`	13 `String` parts	`ADServiceResponse`	Sentinel `Failure` \| `SoapException` outside the two `Try` blocks	Access-checked	BR-01, BR-07
`UnlockAccount`	`clsADUserServices`	`inUserId`	`ADServiceResponse`	Sentinel `Failure` only — never faults*	Access-checked	BR-01, BR-07
`AddUserToGroup`	`clsADUserServices`	`inUserId`, `inGroupName`	`ADServiceResponse`	Sentinel `Failure`/`UserDoesNotExist`/`GroupDoesNotExist`/`UserAlreadyInGroup` — never faults	Access-checked	BR-01, BR-07
`DeleteUser`	`clsADUserServices`	`inUserId`	`ADServiceResponse`	Sentinel `Failure` only — never faults	Access-checked	BR-01, BR-07
`DeleteUserFromGroup`	`clsADUserServices`	`inUserId`, `inGroupName`	`ADServiceResponse`	Sentinel `Success`/`GroupDoesNotExist` — directory failures are caught and swallowed (see faults.md)	Access-checked	BR-01, BR-07
`DoesUserExist`	`clsADUserServices`	`inUserId`, `inExternalDomain`	`Boolean`	Never faults — `False` for absent user and for directory failure alike	None in code	BR-06, BR-07
`DoesUserHaveResource`	`clsADUserServices`	`inUserId`, `inResourceName`, `inExternalDomain`	`ADServiceResponse`	`UserDoesNotExist` \| `SoapException` — no `Try`/`Catch`	None in code	BR-06, BR-07
`ChangeUserAccount`	`clsADUserServices`	10 `String` parts	`ADServiceResponse`	Sentinel `Failure`/`UserDoesNotExist` — never faults	Access-checked	BR-01, BR-07
`ChangeUserPassword`	`clsADUserServices`	`inUserId`, `inNewPassword`	`ADServiceResponse`	Sentinel `Failure` only — never faults	Access-checked	BR-01, BR-07
`ChangeUserPasswordOrGetException`	`clsADUserServices`	`inUserId`, `inNewPassword`	`ADServiceResponse`	`SoapException` — deliberately faulting variant, no `Try`/`Catch`	Access-checked	BR-01, BR-07
`GetUserEmail`	`clsADUserServices`	`inUserId`, `inExternalDomain`	`ADServiceResponse`	Sentinel `Failure`/`UserDoesNotExist` — never faults	None in code	BR-06, BR-07
`GetUserGroups`	`clsADUserServices`	`inUserId`, `inExternalDomain`	`ArrayList`	Never faults — empty `Catch` returns empty list on any failure	None in code	BR-06, BR-07
`GetUserResources`	`clsADUserServices`	`inUserId`, `inProdEnvironment`, `inExternalDomain`	`ArrayList`	Never faults — empty `Catch` returns empty list on any failure	None in code	BR-06, BR-07
`GetUserFAX`	`clsADUserServices`	`inUserId`, `inExternalDomain`	`ADServiceResponse`	Sentinel `Failure`/`UserDoesNotExist` — never faults	None in code	BR-06, BR-07
`GetUserLastLogon`	`clsADUserServices`	`inUserId`, `inExternalDomain`	`ADServiceResponse`	Sentinel `Failure`/`UserDoesNotExist`/`InfoNotAvailable` — never faults	None in code	BR-06, BR-07
`GetUserPrinter`	`clsADUserServices`	`inUserId`	`ADServiceResponse`	Sentinel `Failure`/`UserDoesNotExist` — never faults; internal domain only, no domain parameter offered	None in code	BR-06
`IsUserInGroup`	`clsADUserServices`	`inUserId`, `inGroupName`, `inExternalDomain`	`ADServiceResponse`	Sentinel `Failure`/`UserDoesNotExist`/`GroupDoesNotExist` — never faults	None in code	BR-06, BR-07
`CheckAccess`	`clsADUserServices`	None	`HasAccessResponse`	`SoapException` — no `Try`/`Catch`	None in code — is itself the access-control primitive	BR-02, BR-03, BR-04

Dispatch diagram¶

The following diagram visualizes how a caller reaches a handling operation.

flowchart TD
    REQ["SOAP request"] --> ASMX{"Marker file match<br>clsADUserServices.asmx"}
    ASMX -->|"No match"| NF["No listener at address<br>see faults.md"]
    ASMX -->|"Match"| OPSEL{"Operation selected<br>by SOAP action"}
    OPSEL -->|"Unknown action"| ACTFAULT["SOAP fault<br>method not recognized"]
    OPSEL -->|"8 gated operations"| GATE{"CheckAccess<br>HasAccess?"}
    OPSEL -->|"11 ungated operations"| OP["Operation body executes"]
    GATE -->|"No"| DENY["ADServiceResponse<br>Failure / Access Denied"]
    GATE -->|"Yes"| OP
    OP --> SENTINEL["Sentinel response<br>ADServiceResponse / Boolean / ArrayList"]
    OP --> FAULT["SoapException<br>see faults.md"]

Operations by process¶

Operations that delegate to a documented processing workflow link to it here.

Operation	Process
`HelloWorld`	OP-01
`AddUser`	OP-02
`UnlockAccount`	OP-03
`AddUserToGroup`	OP-04
`DeleteUser`	OP-05
`DeleteUserFromGroup`	OP-06
`DoesUserExist`	OP-07
`DoesUserHaveResource`	OP-08
`ChangeUserAccount`	OP-09
`ChangeUserPassword`	OP-10
`ChangeUserPasswordOrGetException`	OP-11
`GetUserEmail`	OP-12
`GetUserGroups`	OP-13
`GetUserResources`	OP-14
`GetUserFAX`	OP-15
`GetUserLastLogon`	OP-16
`GetUserPrinter`	OP-17
`IsUserInGroup`	OP-18
`CheckAccess`	OP-19

Coverage¶

Check	Result
Service classes with a `.asmx` marker file	1
Service classes with a `contracts/` page	1
`<WebMethod()>` members across all service classes	19
Rows in the operation catalog	19

Note: Statements marked with * were inferred from code structure, naming conventions, or contextual evidence where direct confirmation was not available in source artifacts. Statements marked with ** could not be confirmed; treat as unknown until verified.

Sources¶

src\ADUserServices\clsADUserServices.asmx
src\ADUserServices\clsADUserServices.asmx.vb
.saifdocgen\state\runs\20260922-101326-aduserservices\analysis\aduserservices-analysis.md
.saifdocgen\state\runs\20260922-101326-aduserservices\analysis\aduserservices-security-analysis.md