---
title: Validate user ID format
summary: Applies the same length and disallowed-character rules used for password validation to a candidate user ID.
status: draft
owner: SAIF
last_reviewed: 2026-07-30
library: SAIF.Business.Security.SystemUser
reference_type: package
operation_id: OP-SU-13
trigger: Caller calls clsSystemUser.IsValidUserID(inUserid, [inMinLength], [inMaxLength])
---

# Validate user ID format

`IsValidUserID` mirrors [Validate password format](validate-password-format.md) structurally — same default bounds, same disallowed-character pattern — but is applied to candidate user IDs rather than passwords. It is documented as its own operation because it validates a distinct entity (user ID) governed by its own business rule, even though the implementation logic is duplicated from the password check.

| Field | Value |
| --- | --- |
| **Operation ID** | OP-SU-13 |
| **Trigger** | Caller calls `clsSystemUser.IsValidUserID(inUserid, [inMinLength], [inMaxLength])` |
| **Inputs** | `inUserid` candidate user ID; optional `inMinLength` (default `5`); optional `inMaxLength` (default `20`) |
| **Outputs** | `Boolean` result |
| **Primary components** | `clsSystemUser.IsValidUserID(...)` |
| **Entry point** | `Business\SAIF.Business.Security.SystemUser\clsSystemUser.vb` |

## Steps

1. **Start valid.** `isValid` is initialized to `True`.
2. **Check the maximum length.** If `Len(inUserid) > inMaxLength`, `isValid` is set to `False` ([BR-008](../business-rules.md#br-008-user-ids-follow-password-style-validation-rules)).
3. **Check the minimum length.** Otherwise, if `Len(inUserid) < inMinLength`, `isValid` is set to `False` ([BR-008](../business-rules.md#br-008-user-ids-follow-password-style-validation-rules)).
4. **Check for disallowed characters.** Independent of the length checks, `inUserid Like BADCHARS` is evaluated against the same pattern used by [Validate password format](validate-password-format.md); a match sets `isValid = False` ([BR-008](../business-rules.md#br-008-user-ids-follow-password-style-validation-rules)).
5. **Return the result.** The final `isValid` value is returned.

## Process flow

The following diagram visualizes this operation's control flow.

```mermaid
flowchart TD
	Start([Caller calls IsValidUserID]) --> Init[isValid = True]
	Init --> MaxLen{Len exceeds inMaxLength?}
	MaxLen -->|Yes| Invalid[isValid = False]
	MaxLen -->|No| MinLen{Len below inMinLength?}
	MinLen -->|Yes| Invalid
	MinLen -->|No| CharCheck
	Invalid --> CharCheck{Matches BADCHARS pattern?}
	CharCheck -->|Yes| InvalidChars[isValid = False]
	CharCheck -->|No| Return([Return isValid])
	InvalidChars --> Return
```

## Failure and edge-case behavior

- Because the same default bounds (5–20) and character pattern are reused from password validation, any future change to password rules that is not mirrored here would silently diverge the two checks — the logic is duplicated, not shared.*
- As with password validation, the method does not indicate which specific check (length or characters) caused a `False` result.

## Related documentation

- [Operations and processes](../operations-processes.md)
- [Business rules](../business-rules.md)

> **Note:** Statements marked with `*` were inferred from code structure, naming
> conventions, or contextual evidence where direct confirmation was not available
> in source artifacts.

## Sources

- `Business\SAIF.Business.Security.SystemUser\clsSystemUser.vb`