Script repository

UpdateRoleAssignments -TrusteeSid "S-1-5-21-573937-2149998-410785" `
                      -BaseObjectDN "OU=Sales,DC=company,DC=com" `
                      -ScopeItemType "ADM_SCOPEBASEOBJECTTYPE_CONTAINER" `
                      -Inheritance "ADS_SCOPE_SUBTREE" `
                      -Exclude $False `
                      -RolePath "Adaxes://adaxesserver.company.com:12345/CN=My Role,CN=Security Roles,CN=Access Control,CN=Configuration Objects,CN=Adaxes Configuration,CN=Adaxes"

function UpdateRoleAssignments
{
    Param(
        $trusteeSid,
        $baseObjectDN,
        $scopeItemType,
        $inheritance,
        $exclude,
        $rolePath
    )

    $role = $Context.BindToObject($rolePath)

    # Get role assignments.
    $assignments = $role.Assignments
    $scopeItems = $NULL

    foreach ($assignment in $assignments)
    {
        # Check whether the trustee is already present.
        if ($assignment.Trustee -ine $trusteeSid)
        {
            continue
        }
        
        # Get the assignment scope for the trustee.
        $scopeItems = $assignment.ActivityScopeItems
        break
    }

    if ($scopeItems -eq $NULL)
    {
        # Trustee is not yet present, add trustee.
        $assignment = $role.Assignments.Create()
        $assignment.Trustee = $trusteeSid
        $assignment.SetInfo()
        $assignments.Add($assignment)
        $scopeItems = $assignment.ActivityScopeItems
    }

    # Get the base object GUID.
    if ([System.String]::IsNullOrEmpty($baseObjectDN))
    {
        # All objects
	$baseObject = $NULL
        $baseObjectGuid = [Guid]::Empty
    }
    else
    {
        $baseObject = $Context.BindToObjectByDN($baseObjectDN)
        $baseObjectGuid = [Guid]$baseObject.Get("objectGuid")
    }

    # Check whether item already present in scope.
    $removeExistingItem = $False
    foreach ($item in $scopeItems)
    {
        $scopeBaseObjectGuid = [Guid]$item.Get("adm-ScopeBaseObjectGuid")

        if ($scopeBaseObjectGuid -ine $baseObjectGuid)
        {
            continue
        }

        if ($item.Type -ne $scopeItemType)
        {
            continue
        }

        if ($item.Inheritance -ne $inheritance)
        {
            continue
        }

        if ($item.Exclude -eq $exclude)
        {
            return
        }
        
        # Remove the item.
        $removeExistingItem = $True
        break
    }
    
    if ($removeExistingItem)
    {
        $scopeItems.Remove($item)
    }

    # Add a new item to the assignment scope.
    $scopeItem = $scopeItems.Create()
    $scopeItem.BaseObject = $baseObject
    $scopeItem.Type = $scopeItemType
    $scopeItem.Inheritance = $inheritance
    $scopeItem.Exclude = $exclude
    $scopeItem.SetInfo()
    
    $scopeItems.Add($scopeItem)
}