---
title: SAIF.Business.Security.SystemUser security and authorization
summary: Authorization requirements, AD resource groups, security enforcement points, and data-level access control.
status: draft
owner: SAIF
last_reviewed: 2026-07-24
library: SAIF.Business.Security.SystemUser
reference_type: package
---

# SAIF.Business.Security.SystemUser security and authorization

This library implements security behavior by classifying external Active Directory users through direct group-membership checks and by managing user and group state in AD. It does not expose MVC endpoints or `SAIFAuthorize` attributes; callers consume its classification and credential outcomes to drive higher-level authorization decisions.

## Authorization architecture

`clsSystemUser` combines `clsSecurityPrincipal` role checks, `SAIF.DirectoryServices` user and group operations, and encrypted payment-password comparisons. The primary enforcement path is programmatic: initialization resolves the current principal into a `UserTypes` value, while account-management methods mutate group membership or validate credential-scoped data.

```mermaid
flowchart TD
    Caller[Calling application] --> SystemUser[clsSystemUser]
    SystemUser --> SecPrinc[clsSecurityPrincipal]
    SystemUser --> DirSvc[clsDirectoryServer / clsUser / clsGroup]
    SystemUser --> Encrypt[clsSecureEncrypt]
    SecPrinc --> AD[(EXTERNAL Active Directory)]
    DirSvc --> AD
    Encrypt --> Compare[Encrypted payment-password comparison]
```

## AD resource catalog

| Resource name | Purpose | Enforcement point | Source |
| --- | --- | --- | --- |
| `agents` | Classifies an EXTERNAL-domain user as `UserTypes.Agent`. | `clsSystemUser.GetUserType()` | `Business\SAIF.Business.Security.SystemUser\clsSystemUser.vb` |
| `Producers` | Classifies an EXTERNAL-domain user as `UserTypes.Agent`. | `clsSystemUser.GetUserType()` | `Business\SAIF.Business.Security.SystemUser\clsSystemUser.vb` |
| `ARPAgents` | Classifies an EXTERNAL-domain user as `UserTypes.Agent`. | `clsSystemUser.GetUserType()` | `Business\SAIF.Business.Security.SystemUser\clsSystemUser.vb` |
| `Bookkeepers` | Classifies an EXTERNAL-domain user as `UserTypes.Bookkeeper`. | `clsSystemUser.GetUserType()` | `Business\SAIF.Business.Security.SystemUser\clsSystemUser.vb` |
| `FeeAuditors` | Classifies an EXTERNAL-domain user as `UserTypes.Auditor`. | `clsSystemUser.GetUserType()` | `Business\SAIF.Business.Security.SystemUser\clsSystemUser.vb` |
| `Groups` | Classifies an EXTERNAL-domain user as `UserTypes.Group`. | `clsSystemUser.GetUserType()` | `Business\SAIF.Business.Security.SystemUser\clsSystemUser.vb` |
| `Loss Control` | Classifies an EXTERNAL-domain user as `UserTypes.LossControl`. | `clsSystemUser.GetUserType()` | `Business\SAIF.Business.Security.SystemUser\clsSystemUser.vb` |
| `MCO` | Classifies an EXTERNAL-domain user as `UserTypes.MCO`. | `clsSystemUser.GetUserType()` | `Business\SAIF.Business.Security.SystemUser\clsSystemUser.vb` |
| `Medical Providers` | Classifies an EXTERNAL-domain user as `UserTypes.MedProv`. | `clsSystemUser.GetUserType()` | `Business\SAIF.Business.Security.SystemUser\clsSystemUser.vb` |
| `policyholders` | Classifies an EXTERNAL-domain user as `UserTypes.PolicyHolder`. | `clsSystemUser.GetUserType()` | `Business\SAIF.Business.Security.SystemUser\clsSystemUser.vb` |
| `Workers` | Classifies an EXTERNAL-domain user as `UserTypes.Worker`. | `clsSystemUser.GetUserType()` | `Business\SAIF.Business.Security.SystemUser\clsSystemUser.vb` |
| `Caller-supplied group name` | Targets an AD security group for grant or revoke operations. | `AddUserToRole(...)` / `RemoveUserFromRole(...)` | `Business\SAIF.Business.Security.SystemUser\clsSystemUser.vb` |

## Authorization enforcement points

No attribute-based authorization was detected in this library.

### Programmatic authorization checks

| Class | Method | Resource / Role | Check type | Source |
| --- | --- | --- | --- | --- |
| `clsSystemUser` | `GetUserType()` | EXTERNAL-domain classification groups | `IsInRole` | `Business\SAIF.Business.Security.SystemUser\clsSystemUser.vb` |
| `clsSystemUser` | `AddUserToRole(...)` | Caller-supplied AD group | `AddToGroup` | `Business\SAIF.Business.Security.SystemUser\clsSystemUser.vb` |
| `clsSystemUser` | `RemoveUserFromRole(...)` | Caller-supplied AD group | `RemoveFromGroup` | `Business\SAIF.Business.Security.SystemUser\clsSystemUser.vb` |
| `clsSystemUser` | `UserExists(inUserId As String)` | Named AD user | Existence lookup | `Business\SAIF.Business.Security.SystemUser\clsSystemUser.vb` |

## Data-level authorization

| Entity type | Validation method | Mechanism | Source |
| --- | --- | --- | --- |
| Payment password | `clsSystemUser.CheckPaymentPWD()` | Encrypt the candidate value and compare it to the encrypted AD `MiddleName` value for the loaded user. | `Business\SAIF.Business.Security.SystemUser\clsSystemUser.vb` |
| Payment password | `clsSystemUser.IsUniquePaymentPWD()` | Reject values that match either the stored payment password or the user's login password. | `Business\SAIF.Business.Security.SystemUser\clsSystemUser.vb` |
| Active user context | `clsSystemUser.LoadThisUser()` | Re-point the library's internal directory-user reference to a specific user before later mutating methods execute. | `Business\SAIF.Business.Security.SystemUser\clsSystemUser.vb` |
| Special-user credentials | `clsSystemUser.GetSpecialUserInfo()` | Read restricted credentials from `OnlineProperties.xml` for the `payrollReportsOnly` special-user type. | `Business\SAIF.Business.Security.SystemUser\clsSystemUser.vb` |

## Segregation of duties

No segregation-of-duties rules were identified in the analysis findings for this library.

## Security interfaces and contracts

| Interface / Class | Role | Consumers | Source |
| --- | --- | --- | --- |
| `clsSecurityPrincipal` | Authentication and role-classification context. | `clsSystemUser`, `clsSystemUserTest` | `Business\SAIF.Business.Security.SystemUser\clsSystemUser.vb`; `Business\SAIF.Business.Security.SystemUser\clsSystemUserTest.vb` |
| `clsDirectoryServer` | Directory connection and lookup gateway. | `clsSystemUser` | `Business\SAIF.Business.Security.SystemUser\clsSystemUser.vb` |
| `clsUser` / `clsUserCollection` / `clsGroup` | AD user, collection, and group contracts used for CRUD, search, and role-management flows. | `clsSystemUser` | `Business\SAIF.Business.Security.SystemUser\clsSystemUser.vb` |
| `clsSecureEncrypt` | Encryption contract for payment-password comparison. | `clsSystemUser` | `Business\SAIF.Business.Security.SystemUser\clsSystemUser.vb` |
| `clsProperties` | XML configuration contract for elevated credentials, feature flags, and special-user values. | `clsSystemUser` | `Business\SAIF.Business.Security.SystemUser\clsSystemUser.vb` |

See [Configuration settings](configuration.md) for the `PROPERTIES.XML` and `OnlineProperties.xml` nodes that supply elevated AD bind credentials, agreement-check settings, and special-user values to these security flows.

## Notes
- AD names listed here are raw Active Directory group names used with `IsInRole(...)`; they are not `IsAuthorized` resource names.
- The library operates against the EXTERNAL domain for portal-user classification and account management.

## Related documentation
- [Index](index.md)
- [Overview](overview.md)
- [Architecture](architecture.md)
- [Dependencies](dependencies.md)
- [Configuration settings](configuration.md)
- [Operations and processes](operations-processes.md)
- [Business rules](business-rules.md)
- [API reference](api/index.md)

## Sources
- `Business\SAIF.Business.Security.SystemUser\clsSystemUser.vb`
- `Business\SAIF.Business.Security.SystemUser\clsSystemUserTest.vb`