Skip to content

User access group management

This operation governs how a user type sees and saves EXT_USER_ACCESS_GROUP rows. It combines the static access-group definitions from code tables with the selected rows for a specific user type, then provides helper queries to add or remove AD-backed assignments.

Field Value
Operation ID OP-EU-05
Trigger User-type maintenance loads access groups or saves selected group changes
Inputs User-type ID, user-type code, access type, culture code, AD group list, selected flags
Outputs Possible access-group collection, AD-derived additions/removals, persisted EXT_USER_ACCESS_GROUP rows
Primary components clsUserAccessGroupCollection.GetAllUserTypeAccessGroups, clsUserAccessGroupCollection.GetAllPossibleUserAccessGroups, clsUserAccessGroupCollection.OnSave
Entry point Business\SAIF.Business.External.Users\clsUserAccessGroup.vb

Steps

  1. Load the static access-group definitions for a user type. GetAllUserTypeAccessGroups reads the allowed group definitions from EXT_USER_TYPE_ACCESS_GROUP, joining access-group code text and applying access-type filtering for registration, SAIF employee, or steward views (SQL-023, EXT_USER_ACCESS_GROUP_CODE).
  2. Load the full selectable matrix for one user type. GetAllPossibleUserAccessGroups left-joins the user's actual EXT_USER_ACCESS_GROUP rows onto the allowed definition set so each group comes back either selected or available (SQL-024, EXT_USER_ACCESS_GROUP, EXT_USER_ACCESS_GROUP_CODE).
  3. Load one persisted access-group row when direct retrieval is needed. clsUserAccessGroup retrieves a single row by sequence number and joins back to the user type and definition tables (SQL-022, EXT_USER_ACCESS_GROUP).
  4. Load AD group mappings for a selected access group. The AD-group helper query resolves the AD group names associated with an access-group code (SQL-021, EXT_USER_AD_GROUP, EXT_USER_ACCESS_GROUP_AD).
  5. Find access groups that AD just added. GetAllUnassignedUserAccessGroups loops the supplied AD group names and, for each one, finds mapped access groups that are allowed for the user type but not yet assigned to the user (SQL-025, EXT_USER_ACCESS_GROUP_AD, EXT_USER_ACCESS_GROUP).
  6. Find access groups that AD effectively removed. GetAllRemovedUserAccessGroups builds a NOT IN list from the supplied AD groups, finds assigned groups whose AD mapping is now absent, and maps those IDs back to the possible-group collection (SQL-026, EXT_USER_ACCESS_GROUP, EXT_USER_ACCESS_GROUP_AD, EXT_USER_AD_GROUP).
  7. Track selection changes instead of full-row edits. clsUserAccessGroup.IsDirty is driven by the Selected tracked property, so the collection save logic only reacts to selection flips.
  8. Translate selection changes into inserts and deletes. clsUserAccessGroupCollection.OnSave walks the collection before the base save.
  9. If Selected changed from False to True and no persisted row exists yet, it assigns a new EXT_USER_ACCESS_GROUP_SEQ value, fills UserTypeID, and prepares an insert (SQL-006, EXT_USER_ACCESS_GROUP).
  10. If Selected changed from True to False and a persisted row exists, it queues the row for removal and the base save issues the delete (SQL-053, EXT_USER_ACCESS_GROUP).
  11. If a persisted row remains selected but its metadata changed, it updates the row under UPDATE_NUM concurrency control (BR-EU-05, SQL-047, EXT_USER_ACCESS_GROUP).
  12. Validate access-group combinations through the owning user. clsUser.ValidateAccessGroupsRequired enforces the user-type-specific selection rules before save.
  13. Agency users must choose exactly one agency-style group and cannot mix agency with producer or producer with commission statements.
  14. Policyholders must choose at least one self-registration group, and claim-notes access requires view-policy-and-claim-information access.
  15. Medical providers must choose at least one non-system group, cannot mix bill-search with either claim-profile access, and cannot choose bill-search-claim-profile without claim-profile.

Process flow

The following diagram visualizes this operation's control flow.

flowchart TD
    Start([Access-group load or save]) --> Load[Load definitions and current selections]
    Load --> AD{Reconcile AD groups?}
    AD -->|Yes| Compare[Find added and removed mappings]
    AD -->|No| Select[User edits selections]
    Compare --> Select
    Select --> Validate[Run user-type-specific group validation]
    Validate --> Save[Insert, update, or delete rows based on selection changes]
    Save --> Done([Return saved access-group state])

Failure and edge-case behavior

  • Registration and import flows can bypass some access-group validation paths because the owning user object explicitly disables them for those access types.
  • Agency and medical-provider combinations fail validation before any database write occurs.
  • The AD-removal helper builds a dynamic NOT IN clause from the current AD groups, so an empty or malformed group list changes the removal result set.
  • Persisted group updates fail with DB-contention messaging when UPDATE_NUM no longer matches the stored row (BR-EU-05).

Sources

  • Business\SAIF.Business.External.Users\clsUser.vb
  • Business\SAIF.Business.External.Users\clsUserAccessGroup.vb