Dynamics CRM 2011 - Transfer Security Roles when changing User Business Unit

Question

I am attempting to eliminate the issue of Security Roles being dropped when changing a User's Business Unit in CRM 2011. I have taken a few approaches with varying degrees of success, but none provide a seamless solution. So far a combination of plugins seems to be the best way.

The challenge is this: The Security Roles are dropped after the pre-validation stage, but before the pre-operation stage. I am able to capture the user's security roles in the original Business Unit when I register my plugin on the pre-validation stage if I execute an update other than changing the Business Unit, but the pre-validation plugin does not get triggered when running a Change Business Unit Update (the first stage that occurs is pre-operation). I need to execute the pre-validation plugin when updating the user's Business Unit. Once I get the name of the security role, I can store it in the PluginExecutionContext shared variables, then in my post-stage event plugin, I can query for the new security role with the correct name that is associated with my new Business Unit (that part of the code is working).

Has anyone either figured out how to:

a) transfer a user's security roles from the original BU to a new one (using plugins or not)

OR

b) trigger a plugin registered on the pre-validation stage for a Change User's Business Unit action

Answer 1

Since I was unable to get an answer on this one I'll post my solution (which although I don't love, it does get the job done much more effectively than the usual process of having to go back in and re-add the roles manually).

It is a 2 step process instead of a more elegant 1 step process that I was looking for. I added 2 new fields on the user record, one bit field and one string field.

Step 1) I set up an on-demand workflow that only sets the bit field to yes (which is not on any forms). A plugin fires on change of that field, queries the securityRoles table and gets all records associated with that user, copies down the name of the roles into a pipe delimited string and saves that string to the new string field.
Step 2) When the user changes BUs, that string field is used as the list of new roles to query for in combination with the new BU. Then it is simply a matter of looping through and associating all the new roles with the user.