Skip to content

SAIF.Business.Security.SystemUser operations and processes

This page is the operation catalog and cross-operation hub for SAIF.Business.Security.SystemUser. The library exposes fourteen operations covering caller classification against Active Directory, account search/CRUD/deletion, password and group-membership management, payment-password validation, and portal security configuration reads. Each operation's detailed, step-by-step logic lives in its own page under operations/.

Operation catalog

Operation Intent Trigger Inputs Outputs Rules Tables SQL
Classify authenticated user Resolve the caller's UserTypes classification by domain and AD group membership New clsSystemUser(...) constructor call clsSecurityPrincipal, elevated AD bind credentials UserType, IsXxx classification flags, bound m_DirUser context BR-001, BR-002, BR-003, BR-004, BR-005, BR-013 None None
Search Active Directory users Find EXTERNAL-domain users matching caller-supplied search criteria clsSystemUser.FindUsers(...) User ID, ID number, name, optional test-user flag, optional domain clsUserCollection of matching AD users None catalogued None None
Switch active user context Re-point the library's internal directory-user reference to another AD user clsSystemUser.LoadThisUser(...) Target user ID Boolean result; updated m_DirUser context None catalogued None None
Create or update an external user Persist EXTERNAL-domain account attributes and optional password changes for a new or existing user clsSystemUser.AddNewUser(...) or UpdateUser(...) UserStructure, actor ID Boolean result; created or updated AD entry BR-012 None None
Delete Active Directory user Remove the currently loaded AD user entry clsSystemUser.DeleteUser() Current m_DirUser context Boolean result None catalogued None None
Change Active Directory password Reset a named AD password and optionally record who changed it clsSystemUser.ChangePassword(...) User ID, new password, optional updater ID Boolean result; updated AD password/comment None catalogued None None
Manage group membership Add or remove a user from a named AD security group clsSystemUser.AddUserToRole(...) / RemoveUserFromRole(...) User ID (current or named), group name Boolean result None catalogued None None
Check user existence Determine whether a user exists in Active Directory clsSystemUser.UserExists(...) User ID Boolean result None catalogued None None
Validate payment password Check whether a candidate matches the stored, encrypted payment password clsSystemUser.CheckPaymentPWD(...) Candidate payment password Boolean match result BR-011 None None
Enforce payment password uniqueness Reject payment-password candidates that match the current payment or login credentials clsSystemUser.IsUniquePaymentPWD(...) Candidate payment password, platform Boolean uniqueness result BR-009, BR-010 None None
Generate random password Produce a random password from the restricted character list clsSystemUser.GenerateRandomPWD(...) Optional password length Password string BR-015 None None
Validate password format Enforce password length and disallowed-character rules clsSystemUser.IsValidPassword(...) Candidate password, optional min/max length Boolean result BR-006, BR-007 None None
Validate user ID format Apply password-style validation rules to user IDs clsSystemUser.IsValidUserID(...) Candidate user ID, optional min/max length Boolean result BR-008 None None
Read portal security configuration Load the online-agreement check flag and special-user credentials from XML property files clsSystemUser.CheckOnlineSecurityAgreements() / GetSpecialUserInfo(...) XML properties-file paths and nodes Boolean flag or special-user name/ID values BR-014 None None

Process flow diagram

The following diagram shows how the fourteen operations relate: a caller is classified on construction, then drives account search/CRUD, credential management, and portal configuration reads against Active Directory and XML property files.

flowchart TD
    Start([Caller constructs clsSystemUser]) --> Classify[Classify authenticated user]
    Classify --> Domain{Domain}
    Domain -->|SAIF| Emp([SAIFEmployee])
    Domain -->|EXTERNAL| Roles[Evaluate group-membership checks]
    Domain -->|Other / empty| Unauth([Unauthorized])
    Roles --> Manage[Caller invokes account or credential operation]
    Emp --> Manage
    Manage --> Search[Search Active Directory users]
    Manage --> Switch[Switch active user context]
    Manage --> CreateUpdate[Create or update an external user]
    Manage --> Delete[Delete Active Directory user]
    Manage --> ChangePwd[Change Active Directory password]
    Manage --> Group[Manage group membership]
    Manage --> Exists[Check user existence]
    Manage --> ValidatePay[Validate payment password]
    ValidatePay --> Unique[Enforce payment password uniqueness]
    Manage --> GenPwd[Generate random password]
    Manage --> ValPwd[Validate password format]
    Manage --> ValUid[Validate user ID format]
    Manage --> Config[Read portal security configuration]
    Search --> End([Return result to caller])
    Switch --> End
    CreateUpdate --> End
    Delete --> End
    ChangePwd --> End
    Group --> End
    Exists --> End
    Unique --> End
    GenPwd --> End
    ValPwd --> End
    ValUid --> End
    Config --> End
    Unauth --> End

Failure and edge-case behavior

  • Unknown domains and empty user names return unauthorized classifications through BR-004 and BR-005.
  • Password and user-ID validation enforce the length and character constraints defined by BR-006, BR-007, and BR-008.
  • Agreement checking defaults to enabled unless a resolvable file or node explicitly disables it, per BR-014.
  • Generated passwords use the restricted character set required by BR-015.
  • Several account-mutation operations (AddNewUser, ChangePassword) declare their Boolean result variable but never assign it on the success path, so they can return False even when the underlying Active Directory write succeeded; see the per-operation failure notes for details.*

Note: Statements marked with * were inferred from code structure, naming conventions, or contextual evidence where direct confirmation was not available in source artifacts.

Sources

  • Business\SAIF.Business.Security.SystemUser\clsSystemUser.vb
  • Legacy\SAIFProperties\clsProperties.vb