Skip to content

Commit 5f76324

Browse files
rhouthuijzenrhouthuijzen
authored
Fix: performance improvements (#50)
* Fix: performance improvements * Fixes after review
1 parent c0b9343 commit 5f76324

2 files changed

Lines changed: 62 additions & 31 deletions

File tree

‎README.md‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -31,14 +31,14 @@ _HelloID-Conn-Prov-Target-ActiveDirectory_ is a _target_ connector. This connect
3131

3232
The following features are available:
3333

34-
| Feature | Supported | Actions | Remarks |
35-
| ----------------------------------------- | --------- | ----------------------- | ------------------------------------- |
36-
| **Account Lifecycle** | ✅ | Correlate | |
37-
| **Permissions** | ✅ | Retrieve, Grant, Revoke | Only sub-permissions |
38-
| **Resources** | ✅ | Create, Update | |
39-
| **Entitlement Import: Accounts** | ✅ | - | Only for correlation |
40-
| **Entitlement Import: Permissions** | ✅ | - | Only sub-permissions |
41-
| **Governance Reconciliation Resolutions** | ✅ | - | No actions because of sub-permissions |
34+
| Feature | Supported | Actions | Remarks |
35+
| ----------------------------------------- | --------- | ----------------------- | ---------------------------------------- |
36+
| **Account Lifecycle** | ✅ | Correlate | |
37+
| **Permissions** | ✅ | Retrieve, Grant, Revoke | Only sub-permissions |
38+
| **Resources** | ✅ | Create, Update | |
39+
| **Entitlement Import: Accounts** | ✅ | - | Only for correlation |
40+
| **Entitlement Import: Permissions** | ✅ | - | Only sub-permissions |
41+
| **Governance Reconciliation Resolutions** | ❌ | - | No actions possible with sub-permissions |
4242

4343
## Getting started
4444

‎permissions/groups/importSubPermission.ps1‎

Lines changed: 54 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -13,13 +13,21 @@ try {
1313
$permissionReference = 'dep'
1414
$permissionDisplayName = 'Department'
1515

16-
$filter = "Description -like 'department*'"
16+
$filterGroups = "Description -like 'department*'"
17+
# $filterGroups = "extensionAttribute2 -eq 'HelloIDdepartment'"
1718
# If all groups needs to be queried
18-
# $filter = '*'
19+
# $filterGroups = '*'
1920

20-
# $searchOUs = @("OU=HelloID,OU=Security Groups,DC=enyoi,DC=org","OU=HelloID,OU=Other Groups,DC=enyoi,DC=org")
21-
# If all OUs needs to be queried
22-
$searchOUs = @("")
21+
# $searchGroupOUs = @("OU=HelloID,OU=Security Groups,DC=enyoi,DC=org","OU=HelloID,OU=Other Groups,DC=enyoi,DC=org")
22+
# If all groups needs to be queried
23+
$searchGroupOUs = @("")
24+
25+
# If all users needs to be queried
26+
$filterUsers = '*'
27+
28+
# $searchUserOUs = @("OU=HelloID,OU=Employee Users,DC=enyoi,DC=org","OU=HelloID,OU=Other Users,DC=enyoi,DC=org")
29+
# If all users needs to be queried
30+
$searchUserOUs = @("")
2331

2432
$actionMessage = "getting primary domain controller"
2533
if ([string]::IsNullOrEmpty($actionContext.Configuration.fixedDomainController)) {
@@ -38,36 +46,59 @@ try {
3846
}
3947

4048
$actionMessage = "querying groups"
41-
$properties = @('ObjectGUID', 'Name')
49+
$properties = @('ObjectGUID', 'Name', 'member')
4250
$getADGroupsSplatParams = @{
43-
Filter = $filter
44-
Properties = $properties
45-
Server = $pdc
46-
ErrorAction = 'Stop'
51+
Filter = $filterGroups
52+
Properties = $properties
53+
ResultSetSize = $null
54+
Server = $pdc
55+
ErrorAction = 'Stop'
4756
}
48-
if ([String]::IsNullOrEmpty($searchOUs)) {
49-
Write-Information "Querying AD groups that match filter [$($filter)]"
57+
58+
if ([String]::IsNullOrEmpty($searchGroupOUs)) {
59+
Write-Information "Querying AD groups that match filter [$($filterGroups)]"
5060
$groups = Get-ADGroup @getADGroupsSplatParams | Select-Object $properties
5161
}
5262
else {
53-
$groups = foreach ($searchOU in $searchOUs) {
54-
Write-Information "Querying AD groups that match filter [$($filter)] in OU [$($searchOU)]"
55-
Get-ADGroup @getADGroupsSplatParams -SearchBase $searchOU | Select-Object $properties
63+
$groups = foreach ($searchGroupOU in $searchGroupOUs) {
64+
Write-Information "Querying AD groups that match filter [$($filterGroups)] in OU [$($searchGroupOU)]"
65+
Get-ADGroup @getADGroupsSplatParams -SearchBase $searchGroupOU | Select-Object $properties
5666
}
5767
}
5868
Write-Information "Successfully queried [$($groups.count)] existing groups"
5969

70+
$actionMessage = "querying users"
71+
$properties = @('DistinguishedName', 'ObjectSid')
72+
$getADUsersSplatParams = @{
73+
Filter = $filterUsers
74+
Properties = $properties
75+
ResultSetSize = $null
76+
Server = $pdc
77+
ErrorAction = 'Stop'
78+
}
79+
80+
if ([String]::IsNullOrEmpty($searchUserOUs)) {
81+
Write-Information "Querying AD users that match filter [$($filterUsers)]"
82+
$users = Get-ADUser @getADUsersSplatParams | Select-Object $properties
83+
}
84+
else {
85+
$users = foreach ($searchUserOU in $searchUserOUs) {
86+
Write-Information "Querying AD users that match filter [$($filterUsers)] in OU [$($searchUserOU)]"
87+
Get-ADUser @getADUsersSplatParams -SearchBase $searchUserOU | Select-Object $properties
88+
}
89+
}
90+
$usersGrouped = $users | Group-Object -Property DistinguishedName -AsString -AsHashTable
91+
Write-Information "Successfully queried [$($users.count)] existing users"
92+
6093
$actionMessage = "returning data to HelloID"
6194
foreach ($group in $groups) {
6295
$groupMembers = @()
63-
$getADGroupMembersSplatParams = @{
64-
Identity = $group.ObjectGUID
65-
Recursive = $true
66-
Server = $pdc
67-
ErrorAction = 'Stop'
96+
foreach ($groupMember in $group.member) {
97+
$groupMemberSID = $usersGrouped[$groupMember].ObjectSid.Value
98+
if (-not([string]::IsNullOrEmpty($groupMemberSID))) {
99+
$groupMembers += $groupMemberSID
100+
}
68101
}
69-
$members = Get-ADGroupMember @getADGroupMembersSplatParams
70-
$groupMembers += $members.SID.Value
71102
$numberOfAccounts = $(($groupMembers | Measure-Object).Count)
72103

73104
if (-not([string]::IsNullOrEmpty($group.Name))) {
@@ -81,7 +112,7 @@ try {
81112
PermissionReference = @{
82113
Reference = $permissionReference
83114
}
84-
DisplayName = "Permission - $permissionDisplayName"
115+
DisplayName = $permissionDisplayName
85116
SubPermissionReference = @{
86117
Id = $group.ObjectGUID
87118
}

0 commit comments

Comments
 (0)