---
title: GetUserResources
summary: Returns Resource-named authorization groups filtered by a caller-supplied environment flag.
status: draft
owner: "Not determined from source"
last_reviewed: 2026-09-22
---

# GetUserResources (OP-14)

## Request and response

| Part | Type | Description |
| --- | --- | --- |
| `inUserId` | `String` | The `SamAccountName` to look up. |
| `inProdEnvironment` | `Boolean` | Selects which environment's resource groups are returned; chosen by the caller, not by the deployment environment. |
| `inExternalDomain` | `Boolean` | Selects `external.saif.com` when `True`, `corp.saif.com` when `False` ([BR-07](../business-rules.md#br-07-the-directory-domain-is-selected-by-the-caller)). |

| Part | Type | Description |
| --- | --- | --- |
| `<return>` | `ArrayList` | The filtered group-name strings, untyped on the wire (see [Tech debt](../tech-debt.md) — TD-05). Empty on any failure. |

## WebMethod attributes

`<WebMethod()>` — bare, no arguments supplied.

## Steps

1. No access check is performed ([BR-06](../business-rules.md#br-06-read-only-directory-queries-are-not-access-controlled)).
2. Create an empty `ArrayList`.
3. In a `Try` block, call H2 `GetUserPrincipal` with the caller-supplied `inExternalDomain`.
4. If the principal is found, iterate `userPrin.GetAuthorizationGroups()`; for each group whose `Name` contains `"Resource"` ([BR-29](../business-rules.md#br-29-a-resource-is-a-resource-named-group-filtered-by-caller-supplied-environment)):
   - if the name also contains `"TestResource"`, add it only when `inProdEnvironment = False`;
   - otherwise, add it only when `inProdEnvironment = True`.
   - The two branches are mutually exclusive, so no single call ever sees the full resource picture, and the caller — not the deployment environment — chooses which environment's list is returned (SEC-18, MEDIUM — see [Tech debt](../tech-debt.md) and [Authentication and authorization](../authentication-authorization.md)).
5. `Catch`: **empty block** — the same silent swallow as `GetUserGroups`; every failure yields an empty `ArrayList` (TD-21, HIGH — see [Tech debt](../tech-debt.md)).
6. `Finally`: release `userPrin`.
7. Return the list.

## Process flow

```mermaid
flowchart TD
    A["Call GetUserResources"] --> B["GetUserPrincipal<br>caller-selected domain"]
    B -->|"Nothing"| C["Empty list unchanged"]
    B -->|"Found"| D["Iterate GetAuthorizationGroups"]
    D --> E{"Name contains<br>Resource?"}
    E -->|"No"| D
    E -->|"Yes"| F{"Name contains<br>TestResource?"}
    F -->|"Yes"| G{"inProdEnvironment<br>= False?"}
    F -->|"No"| H{"inProdEnvironment<br>= True?"}
    G -->|"Yes"| I["Add group name"]
    G -->|"No"| D
    H -->|"Yes"| I
    H -->|"No"| D
    B -->|"Exception"| J["Empty Catch block<br>swallows failure"]
    C --> K["Return ArrayList"]
    I --> K
    J --> K
```

## Shared state effects

None — this operation touches no process-wide state; all locals are per-request.

## Error handling

This operation never faults. Every failure path — an unresolved user or a directory exception in the empty `Catch` block — returns the empty `ArrayList` accumulated so far (TD-21, see [Tech debt](../tech-debt.md) and [Faults](../faults.md) for the service-wide fault model).

## Authorization

None in code. This is one of the eleven ungated operations, and the environment scope of the resource list returned is chosen entirely by the caller via `inProdEnvironment` rather than derived from the actual deployment environment (SEC-18, see [Authentication and authorization](../authentication-authorization.md) and [Tech debt](../tech-debt.md)).

## Related documentation
- [Service index](../index.md)
- [Overview](../overview.md)
- [Architecture](../architecture.md)
- [Activation and hosting](../activation-hosting.md)
- [Operations](../operations.md)
- [Operations and processes](../operations-processes.md)
- [Business rules](../business-rules.md)
- [Authentication and authorization](../authentication-authorization.md)
- [Configuration](../configuration.md)
- [Dependencies](../dependencies.md)
- [Faults](../faults.md)
- [Operational runbook](../operational-runbook.md)
- [Tech debt](../tech-debt.md)

## Sources
- `src\ADUserServices\clsADUserServices.asmx.vb` (lines 582-617)