SAIF.Business security and authorization¶
This page documents authorization mechanisms implemented or consumed by SAIF.Business. Authentication is handled by surrounding infrastructure; the library itself implements only authorization, resource checks, and claim-scoped access rules.
Authorization architecture¶
ClaimServices, ImageServices, clsUserType, and ObjectServices use clsSecurityPrincipal and related framework helpers to evaluate AD resources, role membership, and mail-id-scoped access. Claim-facing flows add claim-security data from clsClaimSecurity plus a SQL-based override path so access decisions combine directory authorization and claim-specific data.
flowchart TD
Caller[Calling code] --> ClaimSvc[ClaimServices / ImageServices]
ClaimSvc --> Flags[clsClaimSecurity]
ClaimSvc --> Sec[clsSecurityPrincipal]
ClaimSvc --> Sql[(Oracle override lookup)]
Sec --> AD[(Active Directory)]
Flags --> ClaimApi[CCClaimData API]AD resource catalog¶
| Resource name | Purpose | Enforcement point | Source |
|---|---|---|---|
CollateralHealthClaim |
Grants access to view/handle claims flagged with a collateral health issue | ClaimServices.setImageHealthIssueSecurity → SecurityPrincipal.IsAuthorized("CollateralHealthClaim"); HasHealthIssueAccess → ResourceAccessValid; HasHealthIssueAccessCached → ResourceAccessValidCached |
Business\SAIF.Business\ClaimServices.vb (lines 586, 873, 894) |
ConflictClaim |
Grants access to worker-conflict-flagged claims | ClaimServices conflict-security methods → IsAuthorized/ResourceAccessValid/ResourceAccessValidCached("ConflictClaim") |
Business\SAIF.Business\ClaimServices.vb (lines 917, 938, 959) |
ExposureClaim |
Grants access to claims flagged as an "exposure" claim | ClaimServices exposure-security methods → IsAuthorized/ResourceAccessValid/ResourceAccessValidCached("ExposureClaim") |
Business\SAIF.Business\ClaimServices.vb (lines 979, 1000, 1021) |
Image |
Grants access to secured document-imaging content for a claim | ClaimServices image-security methods → IsAuthorized/ResourceAccessValid/ResourceAccessValidCached("Image"); also ImageServices.HasAccessToClaim → ResourceAccessValidCached(inMailid, "Image") |
Business\SAIF.Business\ClaimServices.vb (lines 1041, 1062, 1083); Business\SAIF.Business\ImageServices.vb (line 486) |
SecureClaim |
Grants access to claims involving a hostile worker | ClaimServices hostile-worker-security methods → IsAuthorized/ResourceAccessValid/ResourceAccessValidCached("SecureClaim") |
Business\SAIF.Business\ClaimServices.vb (lines 1103, 1124, 1145) |
DMClaimUnsecured |
Document-management claim-document access (unsecured tier) | ImageServices.HasAccessToClaim → mySecuritySystem.ResourceAccessValidCached(inMailid, "DMClaimUnsecured") |
Business\SAIF.Business\ImageServices.vb (line 392) |
DMEAIPUnsecured |
Document-management EAIP-document access (unsecured tier) | ImageServices.HasAccessToClaim → ResourceAccessValidCached(inMailid, "DMEAIPUnsecured") |
Business\SAIF.Business\ImageServices.vb (line 404) |
DMPolicyUnSecured |
Document-management policy-document access (unsecured tier) | ImageServices.HasAccessToClaim → ResourceAccessValidCached(inMailid, "DMPolicyUnSecured") (OR'd with DMPolicySecured) |
Business\SAIF.Business\ImageServices.vb (line 435) |
DMPolicySecured |
Document-management policy-document access (secured tier) | ImageServices.HasAccessToClaim → ResourceAccessValidCached(inMailid, "DMPolicySecured") |
Business\SAIF.Business\ImageServices.vb (line 435) |
AgencyExternal (constant AGENT_USER) |
External agent user classification | clsUserType.IsAgent → SecurityPrincipal.IsAuthorized(AGENT_USER) (comment notes legacy AD group name "Agents")* |
Business\SAIF.Business\clsUserType.vb (lines 12, 66) |
ARPAgencyExternal (constant ARP_AGENT_USER) |
External ARP-agent user classification | clsUserType.IsAgent (OR condition) → SecurityPrincipal.IsAuthorized(ARP_AGENT_USER) (legacy AD group "ARPAgents")* |
Business\SAIF.Business\clsUserType.vb (lines 13, 68) |
AuditorExternal (constant AUDITOR_USER) |
External fee-auditor user classification | clsUserType.IsAuditorUser → SecurityPrincipal.IsAuthorized(AUDITOR_USER) (legacy AD group "FeeAuditors")* |
Business\SAIF.Business\clsUserType.vb (lines 14, 78) |
DemoUser (constant DEMO_USER) |
Demo-account user classification | clsUserType.IsDemoUser → SecurityPrincipal.IsAuthorized(DEMO_USER) (legacy AD group "DemoUsers")* |
Business\SAIF.Business\clsUserType.vb (lines 15, 88) |
GroupsOnlineExternal (constant GROUP_USER) |
External "Group" (employer group) user classification | clsUserType.IsGroupUser → SecurityPrincipal.IsAuthorized(GROUP_USER) (legacy AD group "Groups")* |
Business\SAIF.Business\clsUserType.vb (lines 16, 98) |
LossControlExternal (constant LOSS_CONTROL_USER) |
External Loss Control user classification | clsUserType.IsLossControlUser → SecurityPrincipal.IsAuthorized(LOSS_CONTROL_USER) (legacy AD group "Loss Control")* |
Business\SAIF.Business\clsUserType.vb (lines 17, 108) |
ClaimProfileExternalPolicyholder (constant POLICYHOLDER_USER) |
External policyholder user classification | clsUserType.IsPolicyHolder → SecurityPrincipal.IsAuthorized(POLICYHOLDER_USER) |
Business\SAIF.Business\clsUserType.vb (lines 18, 138) |
ProducerExternal (constant PRODUCER_USER) |
External producer user classification | clsUserType.IsProducer → SecurityPrincipal.IsAuthorized(PRODUCER_USER) (legacy AD group "Producers")* |
Business\SAIF.Business\clsUserType.vb (lines 19, 164) |
PolicyPayrollQuickFileExternal (constant QUICK_FILE_USER) |
External "Quick File" payroll user classification | clsUserType.IsQuickFileUser → SecurityPrincipal.IsAuthorized(QUICK_FILE_USER) (legacy AD group "QuickFileUser")* |
Business\SAIF.Business\clsUserType.vb (lines 20, 148) |
UWQuoteUser (constant UWQUOTE_USER) |
Underwriting quote user classification | Constant defined; no call site observed in scanned code — declared but not invoked via IsAuthorized/IsInRole in this library.** |
Business\SAIF.Business\clsUserType.vb (line 21) |
MedicalProvidersExternal (constant MEDICAL_PROVIDER_USER) |
External medical-provider user classification | clsUserType.IsMedicalProvider → SecurityPrincipal.IsAuthorized(MEDICAL_PROVIDER_USER) |
Business\SAIF.Business\clsUserType.vb (lines 22, 128) |
MCO (constant MCO_USER) |
Managed Care Organization user classification | clsUserType.IsMCOUser → SecurityPrincipal.IsInRole(MCO_USER) (note: uses IsInRole, not IsAuthorized, unlike all other clsUserType checks)* |
Business\SAIF.Business\clsUserType.vb (lines 23, 118) |
Caller-supplied resource (generic) |
Generic pass-through authorization/resource-access wrappers exposed for arbitrary resource names | ObjectServices.IsAuthorized(inResource) → clsSecurityPrincipal.Instance.IsAuthorized(inResource); ObjectServices.HasResourceAccess(inMailid, inResource) → ResourceAccessValidCached; ObjectServices.HasResourceAccessExternal(inMailid, inResource) → ResourceAccessValidCachedExternal |
Business\SAIF.Business\ObjectServices.vb (lines 108–170) |
Authorization enforcement points¶
No attribute-based authorization was detected in this library.
Programmatic authorization checks¶
| Class | Method | Resource / Role | Check type | Source |
|---|---|---|---|---|
ClaimServices |
setImageHealthIssueSecurity |
CollateralHealthClaim |
IsAuthorized |
Business\SAIF.Business\ClaimServices.vb |
ClaimServices |
HasHealthIssueAccess |
CollateralHealthClaim |
ResourceAccessValid |
Business\SAIF.Business\ClaimServices.vb |
ClaimServices |
HasHealthIssueAccessCached |
CollateralHealthClaim |
ResourceAccessValidCached |
Business\SAIF.Business\ClaimServices.vb |
ClaimServices |
setConflictSecurity |
ConflictClaim |
IsAuthorized |
Business\SAIF.Business\ClaimServices.vb |
ClaimServices |
HasConflictAccess |
ConflictClaim |
ResourceAccessValid |
Business\SAIF.Business\ClaimServices.vb |
ClaimServices |
HasConflictAccessCached |
ConflictClaim |
ResourceAccessValidCached |
Business\SAIF.Business\ClaimServices.vb |
ClaimServices |
setExposureSecurity |
ExposureClaim |
IsAuthorized |
Business\SAIF.Business\ClaimServices.vb |
ClaimServices |
HasExposureAccess |
ExposureClaim |
ResourceAccessValid |
Business\SAIF.Business\ClaimServices.vb |
ClaimServices |
HasExposureAccessCached |
ExposureClaim |
ResourceAccessValidCached |
Business\SAIF.Business\ClaimServices.vb |
ClaimServices |
setImageSecurity |
Image |
IsAuthorized |
Business\SAIF.Business\ClaimServices.vb |
ClaimServices |
HasImageAccess |
Image |
ResourceAccessValid |
Business\SAIF.Business\ClaimServices.vb |
ClaimServices |
HasImageAccessCached |
Image |
ResourceAccessValidCached |
Business\SAIF.Business\ClaimServices.vb |
ClaimServices |
setHostileWorkerSecurity |
SecureClaim |
IsAuthorized |
Business\SAIF.Business\ClaimServices.vb |
ClaimServices |
HasHostileWorkerAccess |
SecureClaim |
ResourceAccessValid |
Business\SAIF.Business\ClaimServices.vb |
ClaimServices |
HasHostileWorkerAccessCached |
SecureClaim |
ResourceAccessValidCached |
Business\SAIF.Business\ClaimServices.vb |
ImageServices |
HasAccessToClaim |
DMClaimUnsecured |
ResourceAccessValidCached |
Business\SAIF.Business\ImageServices.vb |
ImageServices |
HasAccessToClaim |
DMEAIPUnsecured |
ResourceAccessValidCached |
Business\SAIF.Business\ImageServices.vb |
ImageServices |
HasAccessToClaim |
DMPolicyUnSecured |
ResourceAccessValidCached |
Business\SAIF.Business\ImageServices.vb |
ImageServices |
HasAccessToClaim |
DMPolicySecured |
ResourceAccessValidCached |
Business\SAIF.Business\ImageServices.vb |
ImageServices |
HasAccessToClaim |
Image |
ResourceAccessValidCached |
Business\SAIF.Business\ImageServices.vb |
clsUserType |
IsAgent |
AgencyExternal |
IsAuthorized |
Business\SAIF.Business\clsUserType.vb |
clsUserType |
IsAgent |
ARPAgencyExternal |
IsAuthorized |
Business\SAIF.Business\clsUserType.vb |
clsUserType |
IsAuditorUser |
AuditorExternal |
IsAuthorized |
Business\SAIF.Business\clsUserType.vb |
clsUserType |
IsDemoUser |
DemoUser |
IsAuthorized |
Business\SAIF.Business\clsUserType.vb |
clsUserType |
IsGroupUser |
GroupsOnlineExternal |
IsAuthorized |
Business\SAIF.Business\clsUserType.vb |
clsUserType |
IsLossControlUser |
LossControlExternal |
IsAuthorized |
Business\SAIF.Business\clsUserType.vb |
clsUserType |
IsMedicalProvider |
MedicalProvidersExternal |
IsAuthorized |
Business\SAIF.Business\clsUserType.vb |
clsUserType |
IsMCOUser |
MCO |
IsInRole |
Business\SAIF.Business\clsUserType.vb |
clsUserType |
IsPolicyHolder |
ClaimProfileExternalPolicyholder |
IsAuthorized |
Business\SAIF.Business\clsUserType.vb |
clsUserType |
IsProducer |
ProducerExternal |
IsAuthorized |
Business\SAIF.Business\clsUserType.vb |
clsUserType |
IsQuickFileUser |
PolicyPayrollQuickFileExternal |
IsAuthorized |
Business\SAIF.Business\clsUserType.vb |
ObjectServices |
IsAuthorized |
Caller-supplied resource | IsAuthorized |
Business\SAIF.Business\ObjectServices.vb |
ObjectServices |
HasResourceAccess |
Caller-supplied resource | ResourceAccessValidCached |
Business\SAIF.Business\ObjectServices.vb |
ObjectServices |
HasResourceAccessExternal |
Caller-supplied resource | ResourceAccessValidCachedExternal |
Business\SAIF.Business\ObjectServices.vb |
Data-level authorization¶
| Entity type | Validation method | Mechanism | Source |
|---|---|---|---|
| Claim (document images) | ImageServices.HasAccessToClaim(inDataPortalInfo, inMailid, inClaimNum) |
Composite check: retrieves claim security flags via clsClaimSecurity, then evaluates DMClaimUnsecured/DMEAIPUnsecured/DMPolicyUnSecured/DMPolicySecured/Image AD-resource access via ResourceAccessValidCached, gated by the claim's specific health/conflict/exposure/hostile-worker flags | Business\SAIF.Business\ImageServices.vb |
| Claim | ClaimServices.HasAccessToClaim(inDataPortalInfo, inClaimNum, inMailid) / HasAccessToClaimCached(...) |
Retrieves clsClaimSecurity for the claim (conflict/hostile-worker/exposure/health-issue flags) and combines the relevant AD-resource checks (ConflictClaim, SecureClaim, ExposureClaim, CollateralHealthClaim) with a fallback to HasOverrideAcess when the AD checks fail | Business\SAIF.Business\ClaimServices.vb |
| Claim (per-employee, per-claim override) | ClaimServices.HasOverrideAcess(inDataPortalInfo, inClaimID, inMailid) |
SQL-based ownership/exception check against CL_SECURITY_OVERRIDE/ADP_VIRTUAL_EMPLOYEE_VIEW, scoped to the specific claim ID and mail ID, with an active date-range (EFF_DATE/EXP_DATE) condition | Business\SAIF.Business\ClaimServices.vb |
| Claim (Return-to-Work assignment) | clsClaimSecurity.RTWAssignedToClaim(inDataPortalInfo, ...) |
SQL-based check (RTWSQL criteria route) determining whether an RTW (Return to Work) coordinator/case owner is assigned to the specific claim — a claim-scope enforcement/lookup rather than a raw AD-group gate | Business\SAIF.Business\clsClaimSecurity.vb |
| Claim | ClaimServices.IsClaimAvailableExternalView (per Phase 1 analysis) |
Composite identity-attribute + claim-state check restricting external (policyholder/agent) visibility of a claim | Business\SAIF.Business\ClaimServices.vb |
Segregation of duties¶
No segregation-of-duties checks were identified in the provided findings for this library.
Security interfaces and contracts¶
| Interface / Class | Role | Consumers | Source |
|---|---|---|---|
clsSecurityPrincipal |
Current-user authorization and resource-access gateway. | ClaimServices, clsUserType, ImageServices, ObjectServices |
Business\SAIF.Business\ClaimServices.vb; Business\SAIF.Business\clsUserType.vb; Business\SAIF.Business\ImageServices.vb; Business\SAIF.Business\ObjectServices.vb |
clsAccountMaintProxy |
Mail-id resource-access helper consumed by claim and imaging checks. | ClaimServices, ImageServices |
Business\SAIF.Business\ClaimServices.vb; Business\SAIF.Business\ImageServices.vb |
clsClaimSecurity / clsClaimSecurityData |
Claim-security flag retrieval and claim-scope helper contract. | ClaimServices, ImageServices |
Business\SAIF.Business\clsClaimSecurity.vb; Business\SAIF.Business\CCClaimDataAPI\clsClaimSecurityData.vb |
Notes¶
- AD resource names listed here use the base names observed in code; runtime framework behavior appends environment-specific suffixes where applicable.*
UWQuoteUseris declared inclsUserTypebut no active authorization call site was observed in the provided findings.**
Note: Statements marked with
*were inferred from code structure, naming conventions, or contextual evidence where direct confirmation was not available in source artifacts. Statements marked with**could not be confirmed; treat as unknown until verified.
Related documentation¶
- Index
- Overview
- Architecture
- Dependencies
- Operations and processes
- Business rules
- Database tables
- SQL catalog
- Procedures
- API reference
- Configuration
Sources¶
Business\SAIF.Business\ClaimServices.vbBusiness\SAIF.Business\clsClaimSecurity.vbBusiness\SAIF.Business\clsUserType.vbBusiness\SAIF.Business\ImageServices.vbBusiness\SAIF.Business\ObjectServices.vbBusiness\SAIF.Business\CCClaimDataAPI\clsClaimSecurityData.vb