SAIF.Business.Security.SystemUser security and authorization¶

This library implements security behavior by classifying external Active Directory users through direct group-membership checks and by managing user and group state in AD. It does not expose MVC endpoints or SAIFAuthorize attributes; callers consume its classification and credential outcomes to drive higher-level authorization decisions.

Authorization architecture¶

clsSystemUser combines clsSecurityPrincipal role checks, SAIF.DirectoryServices user and group operations, and encrypted payment-password comparisons. The primary enforcement path is programmatic: initialization resolves the current principal into a UserTypes value, while account-management methods mutate group membership or validate credential-scoped data.

flowchart TD
    Caller[Calling application] --> SystemUser[clsSystemUser]
    SystemUser --> SecPrinc[clsSecurityPrincipal]
    SystemUser --> DirSvc[clsDirectoryServer / clsUser / clsGroup]
    SystemUser --> Encrypt[clsSecureEncrypt]
    SecPrinc --> AD[(EXTERNAL Active Directory)]
    DirSvc --> AD
    Encrypt --> Compare[Encrypted payment-password comparison]

AD resource catalog¶

Resource name	Purpose	Enforcement point	Source
`agents`	Classifies an EXTERNAL-domain user as `UserTypes.Agent`.	`clsSystemUser.GetUserType()`	`Business\SAIF.Business.Security.SystemUser\clsSystemUser.vb`
`Producers`	Classifies an EXTERNAL-domain user as `UserTypes.Agent`.	`clsSystemUser.GetUserType()`	`Business\SAIF.Business.Security.SystemUser\clsSystemUser.vb`
`ARPAgents`	Classifies an EXTERNAL-domain user as `UserTypes.Agent`.	`clsSystemUser.GetUserType()`	`Business\SAIF.Business.Security.SystemUser\clsSystemUser.vb`
`Bookkeepers`	Classifies an EXTERNAL-domain user as `UserTypes.Bookkeeper`.	`clsSystemUser.GetUserType()`	`Business\SAIF.Business.Security.SystemUser\clsSystemUser.vb`
`FeeAuditors`	Classifies an EXTERNAL-domain user as `UserTypes.Auditor`.	`clsSystemUser.GetUserType()`	`Business\SAIF.Business.Security.SystemUser\clsSystemUser.vb`
`Groups`	Classifies an EXTERNAL-domain user as `UserTypes.Group`.	`clsSystemUser.GetUserType()`	`Business\SAIF.Business.Security.SystemUser\clsSystemUser.vb`
`Loss Control`	Classifies an EXTERNAL-domain user as `UserTypes.LossControl`.	`clsSystemUser.GetUserType()`	`Business\SAIF.Business.Security.SystemUser\clsSystemUser.vb`
`MCO`	Classifies an EXTERNAL-domain user as `UserTypes.MCO`.	`clsSystemUser.GetUserType()`	`Business\SAIF.Business.Security.SystemUser\clsSystemUser.vb`
`Medical Providers`	Classifies an EXTERNAL-domain user as `UserTypes.MedProv`.	`clsSystemUser.GetUserType()`	`Business\SAIF.Business.Security.SystemUser\clsSystemUser.vb`
`policyholders`	Classifies an EXTERNAL-domain user as `UserTypes.PolicyHolder`.	`clsSystemUser.GetUserType()`	`Business\SAIF.Business.Security.SystemUser\clsSystemUser.vb`
`Workers`	Classifies an EXTERNAL-domain user as `UserTypes.Worker`.	`clsSystemUser.GetUserType()`	`Business\SAIF.Business.Security.SystemUser\clsSystemUser.vb`
`Caller-supplied group name`	Targets an AD security group for grant or revoke operations.	`AddUserToRole(...)` / `RemoveUserFromRole(...)`	`Business\SAIF.Business.Security.SystemUser\clsSystemUser.vb`

Authorization enforcement points¶

No attribute-based authorization was detected in this library.

Programmatic authorization checks¶

Class	Method	Resource / Role	Check type	Source
`clsSystemUser`	`GetUserType()`	EXTERNAL-domain classification groups	`IsInRole`	`Business\SAIF.Business.Security.SystemUser\clsSystemUser.vb`
`clsSystemUser`	`AddUserToRole(...)`	Caller-supplied AD group	`AddToGroup`	`Business\SAIF.Business.Security.SystemUser\clsSystemUser.vb`
`clsSystemUser`	`RemoveUserFromRole(...)`	Caller-supplied AD group	`RemoveFromGroup`	`Business\SAIF.Business.Security.SystemUser\clsSystemUser.vb`
`clsSystemUser`	`UserExists(inUserId As String)`	Named AD user	Existence lookup	`Business\SAIF.Business.Security.SystemUser\clsSystemUser.vb`

Data-level authorization¶

Entity type	Validation method	Mechanism	Source
Payment password	`clsSystemUser.CheckPaymentPWD()`	Encrypt the candidate value and compare it to the encrypted AD `MiddleName` value for the loaded user.	`Business\SAIF.Business.Security.SystemUser\clsSystemUser.vb`
Payment password	`clsSystemUser.IsUniquePaymentPWD()`	Reject values that match either the stored payment password or the user's login password.	`Business\SAIF.Business.Security.SystemUser\clsSystemUser.vb`
Active user context	`clsSystemUser.LoadThisUser()`	Re-point the library's internal directory-user reference to a specific user before later mutating methods execute.	`Business\SAIF.Business.Security.SystemUser\clsSystemUser.vb`
Special-user credentials	`clsSystemUser.GetSpecialUserInfo()`	Read restricted credentials from `OnlineProperties.xml` for the `payrollReportsOnly` special-user type.	`Business\SAIF.Business.Security.SystemUser\clsSystemUser.vb`

Segregation of duties¶

No segregation-of-duties rules were identified in the analysis findings for this library.

Security interfaces and contracts¶

Interface / Class	Role	Consumers	Source
`clsSecurityPrincipal`	Authentication and role-classification context.	`clsSystemUser`, `clsSystemUserTest`	`Business\SAIF.Business.Security.SystemUser\clsSystemUser.vb`; `Business\SAIF.Business.Security.SystemUser\clsSystemUserTest.vb`
`clsDirectoryServer`	Directory connection and lookup gateway.	`clsSystemUser`	`Business\SAIF.Business.Security.SystemUser\clsSystemUser.vb`
`clsUser` / `clsUserCollection` / `clsGroup`	AD user, collection, and group contracts used for CRUD, search, and role-management flows.	`clsSystemUser`	`Business\SAIF.Business.Security.SystemUser\clsSystemUser.vb`
`clsSecureEncrypt`	Encryption contract for payment-password comparison.	`clsSystemUser`	`Business\SAIF.Business.Security.SystemUser\clsSystemUser.vb`
`clsProperties`	XML configuration contract for elevated credentials, feature flags, and special-user values.	`clsSystemUser`	`Business\SAIF.Business.Security.SystemUser\clsSystemUser.vb`

See Configuration settings for the PROPERTIES.XML and OnlineProperties.xml nodes that supply elevated AD bind credentials, agreement-check settings, and special-user values to these security flows.

Notes¶

AD names listed here are raw Active Directory group names used with IsInRole(...); they are not IsAuthorized resource names.
The library operates against the EXTERNAL domain for portal-user classification and account management.

Sources¶

Business\SAIF.Business.Security.SystemUser\clsSystemUser.vb
Business\SAIF.Business.Security.SystemUser\clsSystemUserTest.vb