---
title: SAIF.Business.Security.SystemUser operations and processes
summary: Operation catalog and cross-operation hub for account classification, Active Directory account management, and credential validation.
status: draft
owner: SAIF
last_reviewed: 2026-07-30
library: SAIF.Business.Security.SystemUser
reference_type: package
---

# SAIF.Business.Security.SystemUser operations and processes

This page is the operation catalog and cross-operation hub for `SAIF.Business.Security.SystemUser`. The library exposes fourteen operations covering caller classification against Active Directory, account search/CRUD/deletion, password and group-membership management, payment-password validation, and portal security configuration reads. Each operation's detailed, step-by-step logic lives in its own page under `operations/`.

## Operation catalog

| Operation | Intent | Trigger | Inputs | Outputs | Rules | Tables | SQL |
| --- | --- | --- | --- | --- | --- | --- | --- |
| [Classify authenticated user](operations/classify-authenticated-user.md) | Resolve the caller's `UserTypes` classification by domain and AD group membership | `New clsSystemUser(...)` constructor call | `clsSecurityPrincipal`, elevated AD bind credentials | `UserType`, `IsXxx` classification flags, bound `m_DirUser` context | [BR-001](business-rules.md#br-001-saif-domain-users-are-classified-as-saifemployee), [BR-002](business-rules.md#br-002-external-users-are-classified-by-prioritized-group-membership), [BR-003](business-rules.md#br-003-webcomp-is-classified-as-saifemployee), [BR-004](business-rules.md#br-004-unknown-domains-are-unauthorized), [BR-005](business-rules.md#br-005-empty-usernames-are-unauthorized), [BR-013](business-rules.md#br-013-external-ldap-binds-use-a-saif-prefix) | None | None |
| [Search Active Directory users](operations/search-active-directory-users.md) | Find EXTERNAL-domain users matching caller-supplied search criteria | `clsSystemUser.FindUsers(...)` | User ID, ID number, name, optional test-user flag, optional domain | `clsUserCollection` of matching AD users | None catalogued | None | None |
| [Switch active user context](operations/switch-active-user-context.md) | Re-point the library's internal directory-user reference to another AD user | `clsSystemUser.LoadThisUser(...)` | Target user ID | `Boolean` result; updated `m_DirUser` context | None catalogued | None | None |
| [Create or update an external user](operations/create-or-update-external-user.md) | Persist EXTERNAL-domain account attributes and optional password changes for a new or existing user | `clsSystemUser.AddNewUser(...)` or `UpdateUser(...)` | `UserStructure`, actor ID | `Boolean` result; created or updated AD entry | [BR-012](business-rules.md#br-012-test-user-flags-are-stored-in-the-ad-description-attribute) | None | None |
| [Delete Active Directory user](operations/delete-active-directory-user.md) | Remove the currently loaded AD user entry | `clsSystemUser.DeleteUser()` | Current `m_DirUser` context | `Boolean` result | None catalogued | None | None |
| [Change Active Directory password](operations/change-active-directory-password.md) | Reset a named AD password and optionally record who changed it | `clsSystemUser.ChangePassword(...)` | User ID, new password, optional updater ID | `Boolean` result; updated AD password/comment | None catalogued | None | None |
| [Manage group membership](operations/manage-group-membership.md) | Add or remove a user from a named AD security group | `clsSystemUser.AddUserToRole(...)` / `RemoveUserFromRole(...)` | User ID (current or named), group name | `Boolean` result | None catalogued | None | None |
| [Check user existence](operations/check-user-existence.md) | Determine whether a user exists in Active Directory | `clsSystemUser.UserExists(...)` | User ID | `Boolean` result | None catalogued | None | None |
| [Validate payment password](operations/validate-payment-password.md) | Check whether a candidate matches the stored, encrypted payment password | `clsSystemUser.CheckPaymentPWD(...)` | Candidate payment password | `Boolean` match result | [BR-011](business-rules.md#br-011-payment-password-comparisons-use-encrypted-values) | None | None |
| [Enforce payment password uniqueness](operations/enforce-payment-password-uniqueness.md) | Reject payment-password candidates that match the current payment or login credentials | `clsSystemUser.IsUniquePaymentPWD(...)` | Candidate payment password, platform | `Boolean` uniqueness result | [BR-009](business-rules.md#br-009-payment-passwords-must-differ-from-the-stored-payment-password), [BR-010](business-rules.md#br-010-payment-passwords-must-differ-from-the-login-password) | None | None |
| [Generate random password](operations/generate-random-password.md) | Produce a random password from the restricted character list | `clsSystemUser.GenerateRandomPWD(...)` | Optional password length | Password string | [BR-015](business-rules.md#br-015-generated-passwords-exclude-visually-ambiguous-characters) | None | None |
| [Validate password format](operations/validate-password-format.md) | Enforce password length and disallowed-character rules | `clsSystemUser.IsValidPassword(...)` | Candidate password, optional min/max length | `Boolean` result | [BR-006](business-rules.md#br-006-password-length-must-stay-within-configured-bounds), [BR-007](business-rules.md#br-007-password-characters-must-exclude-disallowed-symbols) | None | None |
| [Validate user ID format](operations/validate-user-id-format.md) | Apply password-style validation rules to user IDs | `clsSystemUser.IsValidUserID(...)` | Candidate user ID, optional min/max length | `Boolean` result | [BR-008](business-rules.md#br-008-user-ids-follow-password-style-validation-rules) | None | None |
| [Read portal security configuration](operations/read-portal-security-configuration.md) | Load the online-agreement check flag and special-user credentials from XML property files | `clsSystemUser.CheckOnlineSecurityAgreements()` / `GetSpecialUserInfo(...)` | XML properties-file paths and nodes | `Boolean` flag or special-user name/ID values | [BR-014](business-rules.md#br-014-security-agreement-checks-default-to-enabled-unless-a-resolvable-file-or-node-explicitly-disables-them) | None | None |

## Process flow diagram

The following diagram shows how the fourteen operations relate: a caller is classified on construction, then drives account search/CRUD, credential management, and portal configuration reads against Active Directory and XML property files.

```mermaid
flowchart TD
	Start([Caller constructs clsSystemUser]) --> Classify[Classify authenticated user]
	Classify --> Domain{Domain}
	Domain -->|SAIF| Emp([SAIFEmployee])
	Domain -->|EXTERNAL| Roles[Evaluate group-membership checks]
	Domain -->|Other / empty| Unauth([Unauthorized])
	Roles --> Manage[Caller invokes account or credential operation]
	Emp --> Manage
	Manage --> Search[Search Active Directory users]
	Manage --> Switch[Switch active user context]
	Manage --> CreateUpdate[Create or update an external user]
	Manage --> Delete[Delete Active Directory user]
	Manage --> ChangePwd[Change Active Directory password]
	Manage --> Group[Manage group membership]
	Manage --> Exists[Check user existence]
	Manage --> ValidatePay[Validate payment password]
	ValidatePay --> Unique[Enforce payment password uniqueness]
	Manage --> GenPwd[Generate random password]
	Manage --> ValPwd[Validate password format]
	Manage --> ValUid[Validate user ID format]
	Manage --> Config[Read portal security configuration]
	Search --> End([Return result to caller])
	Switch --> End
	CreateUpdate --> End
	Delete --> End
	ChangePwd --> End
	Group --> End
	Exists --> End
	Unique --> End
	GenPwd --> End
	ValPwd --> End
	ValUid --> End
	Config --> End
	Unauth --> End
```

## Failure and edge-case behavior

- Unknown domains and empty user names return unauthorized classifications through [BR-004](business-rules.md#br-004-unknown-domains-are-unauthorized) and [BR-005](business-rules.md#br-005-empty-usernames-are-unauthorized).
- Password and user-ID validation enforce the length and character constraints defined by [BR-006](business-rules.md#br-006-password-length-must-stay-within-configured-bounds), [BR-007](business-rules.md#br-007-password-characters-must-exclude-disallowed-symbols), and [BR-008](business-rules.md#br-008-user-ids-follow-password-style-validation-rules).
- Agreement checking defaults to enabled unless a resolvable file or node explicitly disables it, per [BR-014](business-rules.md#br-014-security-agreement-checks-default-to-enabled-unless-a-resolvable-file-or-node-explicitly-disables-them).
- Generated passwords use the restricted character set required by [BR-015](business-rules.md#br-015-generated-passwords-exclude-visually-ambiguous-characters).
- Several account-mutation operations (`AddNewUser`, `ChangePassword`) declare their Boolean result variable but never assign it on the success path, so they can return `False` even when the underlying Active Directory write succeeded; see the per-operation failure notes for details.*

## Related documentation

- [Index](index.md)
- [Overview](overview.md)
- [Architecture](architecture.md)
- [Dependencies](dependencies.md)
- [Business rules](business-rules.md)
- [Security and authorization](security-authorization.md)
- [API reference](api/index.md)
- [Configuration](configuration.md)

> **Note:** Statements marked with `*` were inferred from code structure, naming
> conventions, or contextual evidence where direct confirmation was not available
> in source artifacts.

## Sources

- `Business\SAIF.Business.Security.SystemUser\clsSystemUser.vb`
- `Legacy\SAIFProperties\clsProperties.vb`