---
title: clsSystemUser
summary: API reference for clsSystemUser.
status: draft
owner: SAIF
last_reviewed: 2026-07-24
library: SAIF.Business.Security.SystemUser
reference_type: package
---

# clsSystemUser

`clsSystemUser` is the library's primary façade for Active Directory user management, EXTERNAL-domain role classification, group-membership changes, and portal credential checks.

## Purpose
- Expose one public class for user classification, user-account lifecycle operations, and credential validation.
- Shield callers from direct `SAIF.DirectoryServices`, XML-properties, and encryption interactions.

## Context
- Namespace: `SAIF.Business.Security.SystemUser`
- Assembly/package: `SAIF.Business.Security.SystemUser` / `SAIF.BOF.Business.Security.SystemUser`

## Public members
| Member | Signature | Purpose |
| --- | --- | --- |
| `New` | `Sub New(inPropertiesFileName As String, inPropertiesFilePath As String, inSecurityPrincipal As clsSecurityPrincipal)` | Read elevated AD credentials from an XML properties file before initialization. |
| `New` | `Sub New(inSecurityPrincipal As clsSecurityPrincipal, inUserid As String, inPWD As String)` | Initialize directly from supplied elevated credentials. |
| `Address` | `ReadOnly Property Address As String` | Return the loaded user's address value. |
| `CompanyName` | `ReadOnly Property CompanyName As String` | Return the loaded user's company name. |
| `CreateDate` | `ReadOnly Property CreateDate As Date` | Return the account create date. |
| `CreatedBy` | `ReadOnly Property CreatedBy As String` | Return the account creator marker stored for the user. |
| `EMail` | `ReadOnly Property EMail As String` | Return the user's email address. |
| `Fax` | `ReadOnly Property Fax As String` | Return the user's fax number. |
| `FirstName` | `ReadOnly Property FirstName As String` | Return the user's first name. |
| `FullName` | `ReadOnly Property FullName As String` | Return the user's full name. |
| `IsAgent` | `ReadOnly Property IsAgent As Boolean` | Return whether `UserType` is `Agent`. |
| `IsAuditor` | `ReadOnly Property IsAuditor As Boolean` | Return whether `UserType` is `Auditor`. |
| `IsBookkeeper` | `ReadOnly Property IsBookkeeper As Boolean` | Return whether `UserType` is `Bookkeeper`. |
| `IsGroup` | `ReadOnly Property IsGroup As Boolean` | Return whether `UserType` is `Group`. |
| `IsLossControl` | `ReadOnly Property IsLossControl As Boolean` | Return whether `UserType` is `LossControl`. |
| `IsMCO` | `ReadOnly Property IsMCO As Boolean` | Return whether `UserType` is `MCO`. |
| `IsMedProvider` | `ReadOnly Property IsMedProvider As Boolean` | Return whether `UserType` is `MedProv`. |
| `IsPolicyHolder` | `ReadOnly Property IsPolicyHolder As Boolean` | Return whether `UserType` is `PolicyHolder`. |
| `IsUnAuthorized` | `ReadOnly Property IsUnAuthorized As Boolean` | Return whether `UserType` is `Unauthorized`. |
| `isValidUser` | `ReadOnly Property isValidUser As Boolean` | Return whether the loaded user state is considered valid. |
| `IsSAIFEmployee` | `ReadOnly Property IsSAIFEmployee As Boolean` | Return whether `UserType` is `SAIFEmployee`. |
| `IsWorker` | `ReadOnly Property IsWorker As Boolean` | Return whether `UserType` is `Worker`. |
| `JobTitle` | `ReadOnly Property JobTitle As String` | Return the user's job title. |
| `LastLogin` | `ReadOnly Property LastLogin As Date` | Return the user's last-login timestamp. |
| `LastName` | `ReadOnly Property LastName As String` | Return the user's last name. |
| `PolicyNum` | `ReadOnly Property PolicyNum As Decimal` | Return the user's policy number. |
| `WorkerID` | `ReadOnly Property WorkerID As Decimal` | Return the user's worker identifier. |
| `AgentNum` | `ReadOnly Property AgentNum As Decimal` | Return the user's agent number. |
| `GroupNum` | `ReadOnly Property GroupNum As String` | Return the user's group number. |
| `GroupChapter` | `ReadOnly Property GroupChapter As String` | Return the user's group chapter. |
| `GroupKey` | `ReadOnly Property GroupKey As String` | Return the user's group key. |
| `Phone` | `ReadOnly Property Phone As String` | Return the user's phone number. |
| `TestUser` | `ReadOnly Property TestUser As Boolean` | Return whether the account is marked as a test user under [BR-012](../../business-rules.md#br-012-test-user-flags-are-stored-in-the-ad-description-attribute). |
| `UpdateDate` | `ReadOnly Property UpdateDate As Date` | Return the account update timestamp. |
| `UpdatedBy` | `ReadOnly Property UpdatedBy As String` | Return the account updater marker stored for the user. |
| `UserCollection` | `ReadOnly Property UserCollection As clsUserCollection` | Return the current collection of located AD users. |
| `UserID` | `ReadOnly Property UserID As String` | Return the loaded user's ID. |
| `UserType` | `ReadOnly Property UserType As UserTypes` | Return the current caller-visible classification. |
| `PaymentPWD` | `Property PaymentPWD As String` | Get or set the encrypted payment-password value stored in AD. |
| `FindUsers` | `Function FindUsers(ByVal inUserID As String, ByVal inIDNumber As String, ByVal inName As String, Optional ByVal inTestUserIDFlag As String = "", Optional ByVal inDomain As String = "EXTERNAL") As SAIF.DirectoryServices.clsUserCollection` | Builds an LDAP query from the supplied criteria and returns matching Active Directory users. |
| `AddNewUser` | `Function AddNewUser(inUserStructure As UserStructure, inCreatedBy As String) As Boolean` | Create a new EXTERNAL-domain user entry. |
| `AddUserToRole` | `Function AddUserToRole(inRoleName As String) As Boolean` | Add the current loaded user to a named AD group. |
| `AddUserToRole` | `Function AddUserToRole(inUserId As String, inRoleName As String) As Boolean` | Add a named user to a named AD group. |
| `ChangePassword` | `Function ChangePassword(ByVal inUserId As String, ByVal inNewPwd As String, Optional ByVal inUpdatedBy As String = "") As Boolean` | Resets the named user's Active Directory password and, if `inUpdatedBy` is supplied, records it on the AD `Comment` attribute. |
| `CheckOnlineSecurityAgreements` | `Function CheckOnlineSecurityAgreements() As Boolean` | Read the online security-agreement flag from XML configuration. |
| `CheckPaymentPWD` | `Function CheckPaymentPWD(inPaymentPwd As String) As Boolean` | Compare a candidate payment password by encrypting it first under [BR-011](../../business-rules.md#br-011-payment-password-comparisons-use-encrypted-values). |
| `DeleteUser` | `Function DeleteUser() As Boolean` | Delete the currently loaded AD user entry. |
| `GenerateRandomPWD` | `Function GenerateRandomPWD(Optional ByVal inLength As Integer = 6) As String` | Generates a random password using the restricted character set defined by [BR-015](../../business-rules.md#br-015-generated-passwords-exclude-visually-ambiguous-characters). |
| `GetSpecialUserInfo` | `Function GetSpecialUserInfo(ByRef specialUserName As String, ByRef specialUserId As String, ByVal utype As specialUserType) As Boolean` | Reads the special-user name/ID pair for the given `specialUserType` from the `SPECIAL_USERS/` node of `OnlineProperties.xml`. |
| `IsUniquePaymentPWD` | `Function IsUniquePaymentPWD(ByVal inPaymentPwd As String, ByVal inPlatform As clsSecurityPrincipal.Platform) As Boolean` | Returns `True` only when the candidate payment password differs from both the stored payment password and the login password, per [BR-009](../../business-rules.md#br-009-payment-passwords-must-differ-from-the-stored-payment-password) and [BR-010](../../business-rules.md#br-010-payment-passwords-must-differ-from-the-login-password). |
| `IsValidPassword` | `Function IsValidPassword(ByVal inPwd As String, Optional ByVal inMinLength As Integer = 5, Optional ByVal inMaxLength As Integer = 20) As Boolean` | Validates password length and character constraints under [BR-006](../../business-rules.md#br-006-password-length-must-stay-within-configured-bounds) and [BR-007](../../business-rules.md#br-007-password-characters-must-exclude-disallowed-symbols). |
| `IsValidUserID` | `Function IsValidUserID(ByVal inUserid As String, Optional ByVal inMinLength As Integer = 5, Optional ByVal inMaxLength As Integer = 20) As Boolean` | Validates user-ID rules under [BR-008](../../business-rules.md#br-008-user-ids-follow-password-style-validation-rules). |
| `LoadThisUser` | `Function LoadThisUser(InUserId As String) As Boolean` | Re-point the internal directory-user reference to the specified user ID. |
| `RemoveUserFromRole` | `Function RemoveUserFromRole(inRoleName As String) As Boolean` | Remove the current loaded user from a named AD group. |
| `RemoveUserFromRole` | `Function RemoveUserFromRole(inUserId As String, inRoleName As String) As Boolean` | Remove a named user from a named AD group. |
| `UpdateUser` | `Function UpdateUser(inUserStructure As UserStructure, inUpdatedBy As String) As Boolean` | Update mapped AD attributes for an existing user. |
| `UserExists` | `Function UserExists(inUserId As String) As Boolean` | Check whether the supplied user ID exists in Active Directory. |

## Behavioral notes
- Initialization applies the classification rules defined by [BR-001](../../business-rules.md#br-001-saif-domain-users-are-classified-as-saifemployee) through [BR-005](../../business-rules.md#br-005-empty-usernames-are-unauthorized).
- `IsValidPassword(...)`, `IsValidUserID(...)`, `CheckPaymentPWD(...)`, and `IsUniquePaymentPWD(...)` implement the validation rules defined by [BR-006](../../business-rules.md#br-006-password-length-must-stay-within-configured-bounds) through [BR-011](../../business-rules.md#br-011-payment-password-comparisons-use-encrypted-values).
- `GenerateRandomPWD(...)` uses the restricted character set required by [BR-015](../../business-rules.md#br-015-generated-passwords-exclude-visually-ambiguous-characters).
- `AddNewUser(...)` declares its `Boolean` return value but never assigns it before returning, so it always returns `False` (the default value) regardless of whether the Active Directory entry was created successfully.

## Constraints and usage notes
- The class assumes an authenticated or authenticatable `clsSecurityPrincipal` plus elevated directory credentials.
- It targets Active Directory user-management flows and does not contain database or BOF data-portal behavior.

## Sources
- `Business\SAIF.Business.Security.SystemUser\clsSystemUser.vb`