AddUserToGroup (OP-04)

Request and response

Part	Type	Description
inUserId	String	The SamAccountName of the user to add to the group.
inGroupName	String	The SamAccountName of the target group.

Part	Type	Description
<return>	ADServiceResponse	Response is Success, UserDoesNotExist, GroupDoesNotExist, UserAlreadyInGroup, or Failure. Message carries the caught exception text on a Failure, otherwise empty.

WebMethod attributes

<WebMethod()> — bare, no arguments supplied.

Steps

1. CheckAccess(); on denial return AccessDenied() (BR-01).
2. Initialize the response sentinel to Success.
3. Open Try.
4. Call H2 GetUserPrincipal for the external domain.
5. If Nothing, set Response = UserDoesNotExist (BR-16).
6. Else call H3 GetGroupPrincipal for the external domain (BR-33).
7. If Nothing, set Response = GroupDoesNotExist (BR-16).
8. Else groupPrin.Members.Add(userPrin) followed by groupPrin.Save().
9. Catch ex As Exception:
10. If ex.Message.Contains("already exists"), set Response = UserAlreadyInGroup (BR-17).
11. Else set Response = Failure, Message = ex.Message.
12. Finally releases both principals.
13. Return the response sentinel.

Process flow

flowchart TD
    A["Call AddUserToGroup"] --> B{"CheckAccess<br>HasAccess?"}
    B -->|"No"| C["Return AccessDenied"]
    B -->|"Yes"| D["GetUserPrincipal<br>external domain"]
    D -->|"Nothing"| E["Set UserDoesNotExist"]
    D -->|"Found"| F["GetGroupPrincipal<br>external domain"]
    F -->|"Nothing"| G["Set GroupDoesNotExist"]
    F -->|"Found"| H["Members.Add + Save"]
    H -.->|"Exception: already exists"| I["Set UserAlreadyInGroup"]
    H -.->|"Other exception"| J["Set Failure + ex.Message"]
    E --> K["Return response"]
    G --> K
    H --> K
    I --> K
    J --> K

Shared state effects

None — this operation touches no process-wide state; all locals are per-request.

Error handling

The operation always returns a sentinel ADServiceResponse; it never surfaces a framework SOAP fault. Duplicate-membership detection depends on an English substring match against the directory exception message, which is locale- and provider-fragile*. See Faults for the service-wide fault model.

Authorization

Gated by BR-01: the caller must pass the IP allow-list check enforced by CheckAccess. See Authentication and authorization.

Note: Statements marked with * were inferred from code structure, naming conventions, or contextual evidence where direct confirmation was not available in source artifacts. Statements marked with ** could not be confirmed; treat as unknown until verified.

Related documentation

• Service index
• Overview
• Architecture
• Activation and hosting
• Operations
• Operations and processes
• Business rules
• Authentication and authorization
• Configuration
• Dependencies
• Faults
• Operational runbook
• Tech debt

Sources

• src\ADUserServices\clsADUserServices.asmx.vb (lines 228-267)