Skip to content

Commit 0e1d26b

Browse files
rhouthuijzenrhouthuijzen
authored
Feature: import entitlements (#49)
* Feature: import entitlements * Fix: Enabled always false
1 parent a739cc6 commit 0e1d26b

6 files changed

Lines changed: 201 additions & 29 deletions

File tree

‎README.md‎

Lines changed: 12 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,3 @@
1-
21
# HelloID-Conn-Prov-Target-ActiveDirectory
32

43
> [!IMPORTANT]
@@ -13,6 +12,7 @@
1312
- [HelloID-Conn-Prov-Target-ActiveDirectory](#helloid-conn-prov-target-activedirectory)
1413
- [Table of contents](#table-of-contents)
1514
- [Introduction](#introduction)
15+
- [Supported features](#supported--features)
1616
- [Getting started](#getting-started)
1717
- [HelloID Icon URL](#helloid-icon-url)
1818
- [Provisioning PowerShell V2 connector](#provisioning-powershell-v2-connector)
@@ -27,15 +27,18 @@
2727

2828
_HelloID-Conn-Prov-Target-ActiveDirectory_ is a _target_ connector. This connector is used to dynamically add Active Directory groups to Active Directory users by assigning subPermissions within HelloID.
2929

30-
The following lifecycle actions are available:
30+
## Supported features
31+
32+
The following features are available:
3133

32-
| Action | Description |
33-
| ------------------------------------- | ------------------------------------------------------------------------ |
34-
| create.ps1 | PowerShell _create_ lifecycle action. This action correlates the account |
35-
| permissions/groups/subPermissions.ps1 | PowerShell _subPermissions_ lifecycle action |
36-
| resources/groups/resources.ps1 | PowerShell _resources_ lifecycle action |
37-
| configuration.json | Default _configuration.json_ |
38-
| fieldMapping.json | Default _fieldMapping.json_ |
34+
| Feature | Supported | Actions | Remarks |
35+
| ----------------------------------------- | --------- | ----------------------- | ------------------------------------- |
36+
| **Account Lifecycle** | ✅ | Correlate | |
37+
| **Permissions** | ✅ | Retrieve, Grant, Revoke | Only sub-permissions |
38+
| **Resources** | ✅ | Create, Update | |
39+
| **Entitlement Import: Accounts** | ✅ | - | Only for correlation |
40+
| **Entitlement Import: Permissions** | ✅ | - | Only sub-permissions |
41+
| **Governance Reconciliation Resolutions** | ✅ | - | No actions because of sub-permissions |
3942

4043
## Getting started
4144

‎configuration.json‎

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -19,15 +19,5 @@
1919
"description": "When toggled, resources will be renamed",
2020
"required": false
2121
}
22-
},
23-
{
24-
"key": "isDebug",
25-
"type": "checkbox",
26-
"defaultValue": false,
27-
"templateOptions": {
28-
"label": "Toggle debug logging",
29-
"description": "When toggled, debug logging will be displayed",
30-
"required": false
31-
}
3222
}
3323
]

‎create.ps1‎

Lines changed: 2 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -11,13 +11,6 @@ $outputContext.Success = $false
1111

1212
# AccountReference must have a value for dryRun
1313
$outputContext.AccountReference = "Unknown"
14-
15-
# Set debug logging
16-
switch ($($actionContext.Configuration.isDebug)) {
17-
$true { $VerbosePreference = 'Continue' }
18-
$false { $VerbosePreference = 'SilentlyContinue' }
19-
}
20-
2114
$account = $actionContext.Data
2215

2316
try {
@@ -57,7 +50,7 @@ try {
5750
}
5851
}
5952
else {
60-
Write-Verbose "A fixed domain controller is configured [$($actionContext.Configuration.fixedDomainController)]"
53+
Write-Information "A fixed domain controller is configured [$($actionContext.Configuration.fixedDomainController)]"
6154
$pdc = $($actionContext.Configuration.fixedDomainController)
6255
}
6356
#endregion Get Primary Domain Controller
@@ -67,7 +60,7 @@ try {
6760

6861
$user = Get-ADUser -Filter "$correlationField -eq '$correlationValue'" -Server $pdc -ErrorAction Stop
6962

70-
Write-Verbose "Queried Microsoft Active Directory account where [$($correlationField)] = [$($correlationValue)]. Result: $($user | ConvertTo-Json)"
63+
Write-Information "Queried Microsoft Active Directory account where [$($correlationField)] = [$($correlationValue)]. Result: $($user | ConvertTo-Json)"
7164
#endregion Get Microsoft Active Directory account
7265

7366
#region Calulate action

‎import.ps1‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
#################################################
2+
# HelloID-Conn-Prov-Target-ActiveDirectory-Import
3+
# PowerShell V2
4+
#################################################
5+
6+
# Enable TLS1.2
7+
[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor [System.Net.SecurityProtocolType]::Tls12
8+
9+
try {
10+
Write-Information 'Starting target account import'
11+
$importFields = $($actionContext.ImportFields)
12+
13+
# Add mandatory fields for HelloID to query and return
14+
if ('SID' -notin $importFields) { $importFields += 'SID' }
15+
if ('Enabled' -notin $importFields) { $importFields += 'Enabled ' }
16+
if ('Name' -notin $importFields) { $importFields += 'Name' }
17+
if ('UserPrincipalName' -notin $importFields) { $importFields += 'UserPrincipalName' }
18+
Write-Information "Querying fields [$importFields]"
19+
20+
$actionMessage = "getting primary domain controller"
21+
if ([string]::IsNullOrEmpty($actionContext.Configuration.fixedDomainController)) {
22+
try {
23+
$pdc = (Get-ADForest | Select-Object -ExpandProperty RootDomain | Get-ADDomain | Select-Object -Property PDCEmulator).PDCEmulator
24+
}
25+
catch {
26+
Write-Warning ("PDC Lookup Error: {0}" -f $_.Exception.InnerException.Message)
27+
Write-Warning "Retrying PDC Lookup"
28+
$pdc = (Get-ADForest | Select-Object -ExpandProperty RootDomain | Get-ADDomain | Select-Object -Property PDCEmulator).PDCEmulator
29+
}
30+
}
31+
else {
32+
Write-Information "A fixed domain controller is configured [$($actionContext.Configuration.fixedDomainController)]"
33+
$pdc = $($actionContext.Configuration.fixedDomainController)
34+
}
35+
36+
$actionMessage = "querying accounts"
37+
$properties = @(
38+
@{Name = 'SID'; Expression = { $_.SID.Value } }
39+
@{Name = 'Enabled'; Expression = { [bool]$_.Enabled } }
40+
) + ($importFields | Where-Object { ($_ -ne 'SID') -and ($_ -ne 'Enabled') })
41+
42+
$getADUsersSplatParams = @{
43+
Filter = '*'
44+
Properties = $importFields
45+
Server = $pdc
46+
ErrorAction = 'Stop'
47+
}
48+
$existingAccounts = Get-ADUser @getADUsersSplatParams | Select-Object -Property $properties
49+
Write-Information "Successfully queried [$($existingAccounts.count)] existing accounts"
50+
51+
$actionMessage = "returning data to HelloID"
52+
foreach ($account in $existingAccounts) {
53+
if ([string]::IsNullOrEmpty($account.Name)) {
54+
$account.Name = $account.SID
55+
}
56+
if ([string]::IsNullOrEmpty($account.UserPrincipalName)) {
57+
$account.UserPrincipalName = $account.SID
58+
}
59+
Write-Output @{
60+
AccountReference = $account.SID
61+
DisplayName = $account.Name
62+
UserName = $account.UserPrincipalName
63+
Enabled = $false # No account access is granted, this should be false for the report. $account.Enabled
64+
Data = $account
65+
}
66+
}
67+
Write-Information 'Target account import completed'
68+
}
69+
catch {
70+
$ex = $PSItem
71+
$auditMessage = "Error $($actionMessage). Error: $($ex.Exception.Message)"
72+
$warningMessage = "Error at Line [$($ex.InvocationInfo.ScriptLineNumber)]: $($ex.InvocationInfo.Line). Error: $($ex.Exception.Message)"
73+
Write-Warning $warningMessage
74+
Write-Error $auditMessage
75+
}

‎permissions/groups/importSubPermission.ps1‎

Lines changed: 111 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,111 @@
1+
#################################################
2+
# HelloID-Conn-Prov-Target-ActiveDirectory-ImportSubPermission
3+
# PowerShell V2
4+
#################################################
5+
6+
# Enable TLS1.2
7+
[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor [System.Net.SecurityProtocolType]::Tls12
8+
9+
try {
10+
Write-Information 'Starting target sub-permissions import '
11+
12+
# Configure, must be the same as the values used in retrieve permissions
13+
$permissionReference = 'dep'
14+
$permissionDisplayName = 'Department'
15+
16+
$filter = "Description -like 'department*'"
17+
# If all groups needs to be queried
18+
# $filter = '*'
19+
20+
# $searchOUs = @("OU=HelloID,OU=Security Groups,DC=enyoi,DC=org","OU=HelloID,OU=Other Groups,DC=enyoi,DC=org")
21+
# If all OUs needs to be queried
22+
$searchOUs = @("")
23+
24+
$actionMessage = "getting primary domain controller"
25+
if ([string]::IsNullOrEmpty($actionContext.Configuration.fixedDomainController)) {
26+
try {
27+
$pdc = (Get-ADForest | Select-Object -ExpandProperty RootDomain | Get-ADDomain | Select-Object -Property PDCEmulator).PDCEmulator
28+
}
29+
catch {
30+
Write-Warning ("PDC Lookup Error: {0}" -f $_.Exception.InnerException.Message)
31+
Write-Warning "Retrying PDC Lookup"
32+
$pdc = (Get-ADForest | Select-Object -ExpandProperty RootDomain | Get-ADDomain | Select-Object -Property PDCEmulator).PDCEmulator
33+
}
34+
}
35+
else {
36+
Write-Information "A fixed domain controller is configured [$($actionContext.Configuration.fixedDomainController)]"
37+
$pdc = $($actionContext.Configuration.fixedDomainController)
38+
}
39+
40+
$actionMessage = "querying groups"
41+
$properties = @('ObjectGUID', 'Name')
42+
$getADGroupsSplatParams = @{
43+
Filter = $filter
44+
Properties = $properties
45+
Server = $pdc
46+
ErrorAction = 'Stop'
47+
}
48+
if ([String]::IsNullOrEmpty($searchOUs)) {
49+
Write-Information "Querying AD groups that match filter [$($filter)]"
50+
$groups = Get-ADGroup @getADGroupsSplatParams | Select-Object $properties
51+
}
52+
else {
53+
$groups = foreach ($searchOU in $searchOUs) {
54+
Write-Information "Querying AD groups that match filter [$($filter)] in OU [$($searchOU)]"
55+
Get-ADGroup @getADGroupsSplatParams -SearchBase $searchOU | Select-Object $properties
56+
}
57+
}
58+
Write-Information "Successfully queried [$($groups.count)] existing groups"
59+
60+
$actionMessage = "returning data to HelloID"
61+
foreach ($group in $groups) {
62+
$groupMembers = @()
63+
$getADGroupMembersSplatParams = @{
64+
Identity = $group.ObjectGUID
65+
Recursive = $true
66+
Server = $pdc
67+
ErrorAction = 'Stop'
68+
}
69+
$members = Get-ADGroupMember @getADGroupMembersSplatParams
70+
$groupMembers += $members.SID.Value
71+
$numberOfAccounts = $(($groupMembers | Measure-Object).Count)
72+
73+
if (-not([string]::IsNullOrEmpty($group.Name))) {
74+
$displayname = $($group.Name).substring(0, [System.Math]::Min(100, $($group.Name).Length))
75+
}
76+
else {
77+
$displayname = $group.ObjectGUID
78+
}
79+
80+
$permission = @{
81+
PermissionReference = @{
82+
Reference = $permissionReference
83+
}
84+
DisplayName = "Permission - $permissionDisplayName"
85+
SubPermissionReference = @{
86+
Id = $group.ObjectGUID
87+
}
88+
SubPermissionDisplayName = $displayName
89+
}
90+
91+
# Batch permissions based on the amount of account references,
92+
# to make sure the output objects are not above the limit
93+
$accountsBatchSize = 500
94+
if ($numberOfAccounts -gt 0) {
95+
$accountsBatchSize = 500
96+
$batches = 0..($numberOfAccounts - 1) | Group-Object { [math]::Floor($_ / $accountsBatchSize ) }
97+
foreach ($batch in $batches) {
98+
$permission.AccountReferences = [array]($batch.Group | ForEach-Object { @($groupMembers[$_]) })
99+
Write-Output $permission
100+
}
101+
}
102+
}
103+
Write-Information 'Target sub-permissions import completed'
104+
}
105+
catch {
106+
$ex = $PSItem
107+
$auditMessage = "Error $($actionMessage). Error: $($ex.Exception.Message)"
108+
$warningMessage = "Error at Line [$($ex.InvocationInfo.ScriptLineNumber)]: $($ex.InvocationInfo.Line). Error: $($ex.Exception.Message)"
109+
Write-Warning $warningMessage
110+
Write-Error $auditMessage
111+
}

‎permissions/groups/subPermission.ps1‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
#####################################################
2-
# HelloID-Conn-Prov-Target-ActiveDirectory-subPermissions-Groups
2+
# HelloID-Conn-Prov-Target-ActiveDirectory-SubPermissions-Groups
33
# PowerShell V2
44
#################################################
55

0 commit comments

Comments
 (0)