Skip to content

GetUserResources (OP-14)

Request and response

Part Type Description
inUserId String The SamAccountName to look up.
inProdEnvironment Boolean Selects which environment's resource groups are returned; chosen by the caller, not by the deployment environment.
inExternalDomain Boolean Selects external.saif.com when True, corp.saif.com when False (BR-07).
Part Type Description
<return> ArrayList The filtered group-name strings, untyped on the wire (see Tech debt — TD-05). Empty on any failure.

WebMethod attributes

<WebMethod()> — bare, no arguments supplied.

Steps

  1. No access check is performed (BR-06).
  2. Create an empty ArrayList.
  3. In a Try block, call H2 GetUserPrincipal with the caller-supplied inExternalDomain.
  4. If the principal is found, iterate userPrin.GetAuthorizationGroups(); for each group whose Name contains "Resource" (BR-29):
  5. if the name also contains "TestResource", add it only when inProdEnvironment = False;
  6. otherwise, add it only when inProdEnvironment = True.
  7. The two branches are mutually exclusive, so no single call ever sees the full resource picture, and the caller — not the deployment environment — chooses which environment's list is returned (SEC-18, MEDIUM — see Tech debt and Authentication and authorization).
  8. Catch: empty block — the same silent swallow as GetUserGroups; every failure yields an empty ArrayList (TD-21, HIGH — see Tech debt).
  9. Finally: release userPrin.
  10. Return the list.

Process flow

flowchart TD
    A["Call GetUserResources"] --> B["GetUserPrincipal<br>caller-selected domain"]
    B -->|"Nothing"| C["Empty list unchanged"]
    B -->|"Found"| D["Iterate GetAuthorizationGroups"]
    D --> E{"Name contains<br>Resource?"}
    E -->|"No"| D
    E -->|"Yes"| F{"Name contains<br>TestResource?"}
    F -->|"Yes"| G{"inProdEnvironment<br>= False?"}
    F -->|"No"| H{"inProdEnvironment<br>= True?"}
    G -->|"Yes"| I["Add group name"]
    G -->|"No"| D
    H -->|"Yes"| I
    H -->|"No"| D
    B -->|"Exception"| J["Empty Catch block<br>swallows failure"]
    C --> K["Return ArrayList"]
    I --> K
    J --> K

Shared state effects

None — this operation touches no process-wide state; all locals are per-request.

Error handling

This operation never faults. Every failure path — an unresolved user or a directory exception in the empty Catch block — returns the empty ArrayList accumulated so far (TD-21, see Tech debt and Faults for the service-wide fault model).

Authorization

None in code. This is one of the eleven ungated operations, and the environment scope of the resource list returned is chosen entirely by the caller via inProdEnvironment rather than derived from the actual deployment environment (SEC-18, see Authentication and authorization and Tech debt).

Sources

  • src\ADUserServices\clsADUserServices.asmx.vb (lines 582-617)