create.ps1

#################################################
# HelloID-Conn-Prov-Target-EmpireDynamics-Create
# PowerShell V2
#################################################

# Enable TLS1.2
[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor [System.Net.SecurityProtocolType]::Tls12

#region functions
function Resolve-EmpireError {
    [CmdletBinding()]
    param (
        [Parameter(Mandatory)]
        [object]
        $ErrorObject
    )
    process {
        $httpErrorObj = [PSCustomObject]@{
            ScriptLineNumber = $ErrorObject.InvocationInfo.ScriptLineNumber
            Line             = $ErrorObject.InvocationInfo.Line
            ErrorDetails     = $ErrorObject.Exception.Message
            FriendlyMessage  = $ErrorObject.Exception.Message
        }
        if (-not [string]::IsNullOrEmpty($ErrorObject.ErrorDetails.Message)) {
            $httpErrorObj.ErrorDetails = $ErrorObject.ErrorDetails.Message
        }
        elseif ($ErrorObject.Exception.GetType().FullName -eq 'System.Net.WebException') {
            if ($null -ne $ErrorObject.Exception.Response) {
                $streamReaderResponse = [System.IO.StreamReader]::new($ErrorObject.Exception.Response.GetResponseStream()).ReadToEnd()
                if (-not [string]::IsNullOrEmpty($streamReaderResponse)) {
                    $httpErrorObj.ErrorDetails = $streamReaderResponse
                }
            }
        }
        try {
            $errorDetailsObject = ($httpErrorObj.ErrorDetails | ConvertFrom-Json)
            # Make sure to inspect the error result object and add only the error message as a FriendlyMessage.
            # $httpErrorObj.FriendlyMessage = $errorDetailsObject.message
            $httpErrorObj.FriendlyMessage = $httpErrorObj.ErrorDetails # Temporarily assignment
        }
        catch {
            $httpErrorObj.FriendlyMessage = $httpErrorObj.ErrorDetails
        }
        Write-Output $httpErrorObj
    }
}
#endregion

try {
    # Create session
    $s = New-PSSession -ComputerName $actionContext.Configuration.Applicationserver

    # Define variables
    $EmailAddress = $actionContext.Data.EmailAddress
    $SamAccountName = $actionContext.Data.Username
    $UserPrincipalName = $actionContext.Data.userPrincipalName
    $Fullname = $actionContext.Data.FullName

    $PSPath = $actionContext.Configuration.PSModulePath
    $NavServerInstanceName = $actionContext.Configuration.NavServerInstanceName
    $tenant = $actionContext.Configuration.Tenant


    # Import module
    $Import = Invoke-Command -Session $s -ScriptBlock {
        param($ImportPath)
        Import-Module $ImportPath -ErrorAction Stop
    } -ArgumentList $PSPath

    # Initial assignment
    $outputContext.AccountReference = 'Currently not available'

    # Determine action (Create or Correlate)
    if ($actionContext.CorrelationConfiguration.Enabled) {
        try {
            $correlatedAccount = Invoke-Command -Session $s -ScriptBlock {
                param($ServerInstance, $Tenant, $UserName)
                Get-NAVServerUser -ServerInstance $ServerInstance -Tenant $Tenant |
                Where-Object { $_.UserName -eq $UserName }
            } -ArgumentList $NavServerInstanceName, $tenant, $SamAccountName

        }
        catch {
            throw "Error while checking for existing NAV user: $($_.Exception.Message)"
        }
    }
    else {
        throw "Correlation for this connector is mandatory"
    }

    if ($null -ne $correlatedAccount) {
        $action = 'CorrelateAccount'
    }
    else {
        $action = 'CreateAccount'
    }

    # Add a message and the result of each of the validations showing what will happen during enforcement
    if ($actionContext.DryRun -eq $true) {
        Write-Information "[DryRun] $action Authorizationbox account for: [$($personContext.Person.DisplayName)], will be executed during enforcement"
    }

    switch ($action) {
        'CreateAccount' {
            Write-Information 'Creating Nav User'

            if (-not($actionContext.DryRun -eq $true)) {
                #Create user
                $createUser = Invoke-Command -Session $s -ScriptBlock {
                    param(
                        $ServerInstance,
                        $Tenant,
                        $SamAccountName,
                        $Displayname,
                        $UserPrincipalName,
                        $EmailAddress
                    )
                    New-NAVServerUser `
                        -ServerInstance      $ServerInstance `
                        -Tenant              $Tenant `
                        -WindowsAccount      $SamAccountName `
                        -FullName            $Displayname `
                        -AuthenticationEmail $UserPrincipalName `
                        -ContactEmail        $EmailAddress `
                        -State          Enabled `
                        -Verbose
                } -ArgumentList $NavServerInstanceName, $tenant, $SamAccountName, $Fullname, $UserPrincipalName, $EmailAddress
                
                #Set permissions 
                <#
                $setPermissions = Invoke-Command -Session $s -ScriptBlock {
                    param(
                        $ServerInstance,
                        $Tenant,
                        $SamAccountName,
                        $PermissionSetId
                    )
                    New-NAVServerUserPermissionSet `
                        -ServerInstance   $ServerInstance `
                        -Tenant           $Tenant `
                        -WindowsAccount   $SamAccountName `
                        -PermissionSetId  $PermissionSetId `
                        -ErrorAction      SilentlyContinue `
                        -Verbose
                } -ArgumentList $NavServerInstanceName, $tenant, $SamAccountName, 'SUPER'
                #>

                #Try another get user for setting aref
                $result = Invoke-Command -Session $s -ScriptBlock {
                    param($ServerInstance, $Tenant, $UserName)
                    Get-NAVServerUser -ServerInstance $ServerInstance -Tenant $Tenant |
                    Where-Object { $_.UserName -eq $UserName }
                } -ArgumentList $NavServerInstanceName, $tenant, $SamAccountName

                $outputContext.Data.UserSecurityID = $result.UserSecurityID
                $outputContext.Data.FullName = $result.Fullname
                $outputContext.Data.UserName = $result.Username

                $auditLogMessage = "Create account was successful. AccountReference is: [$($outputContext.Data.UserSecurityID)]"
    
            }
            else {
                Write-Information 'Dryrun prevented this action'
            }
            break
        }

        'CorrelateAccount' {
            Write-Information 'Correlating Nav User'

            $outputContext.Data.UserSecurityID = $correlatedAccount.UserSecurityID
            $outputContext.Data.Fullname = $correlatedAccount.Fullname
            $outputContext.Data.UserName = $correlatedAccount.Username

            $outputContext.AccountCorrelated = $true
            $auditLogMessage = "Correlated account: [$($actionContext.Data.Username)]. AccountReference is: [$($outputContext.Data.UserSecurityID)]"
            break
        }
    }

    $accountRef = [PSCustomObject]@{
        UserSecurityID  = $outputContext.Data.UserSecurityID
        Fullname = $outputContext.Data.Fullname
        UserName    = $outputContext.Data.UserName
    }

    $outputContext.AccountReference = $accountRef
    $outputContext.Success = $true

    $outputContext.AuditLogs.Add([PSCustomObject]@{
            Action  = $action
            Message = $auditLogMessage
            IsError = $false
        })

    # Remove session
    $exit = if ($s) { Remove-PSSession $s }
}
catch {
    $outputContext.Success = $false
    $ex = $PSItem
    $exit = if ($s) { Remove-PSSession $s }
    if ($($ex.Exception.GetType().FullName -eq 'Microsoft.PowerShell.Commands.HttpResponseException') -or
        $($ex.Exception.GetType().FullName -eq 'System.Net.WebException')) {
        $errorObj = Resolve-EmpireError -ErrorObject $ex
        $auditMessage = "Could not create or correlate EmpireDynamics account. Error: $($errorObj.FriendlyMessage)"
        Write-Warning "Error at Line '$($errorObj.ScriptLineNumber)': $($errorObj.Line). Error: $($errorObj.ErrorDetails)"
    }
    else {
        $auditMessage = "Could not create or correlate EmpireDynamics account. Error: $($ex.Exception.Message)"
        Write-Warning "Error at Line '$($ex.InvocationInfo.ScriptLineNumber)': $($ex.InvocationInfo.Line). Error: $($ex.Exception.Message)"
    }
    $outputContext.AuditLogs.Add([PSCustomObject]@{
            Message = $auditMessage
            IsError = $true
        })
}