Script repository
The scripts check membership of the target object against a list of groups. The scripts should be executed in the If PowerShell script returns true condition. To execute either of the scripts, create a business rule, custom command or scheduled task configured for the required object type.
In the scripts, the $groupDNs variable specifies the list of distinguished names (DNs) of the groups to check. For information on how to get an object DN, see Get the DN of a directory object.
Script 1: Return true if the target object is a member of all the groups
$groupDNs = @(
"CN=Group 1,OU=Groups,DC=company,DC=com",
"CN=Group 2,OU=Groups,DC=company,DC=com",
"CN=Group 3,OU=Groups,DC=company,DC=com",
"CN=Group 4,OU=Groups,DC=subdomain.DC=company,DC=com")
$Context.ConditionIsMet = $False
# Get the group GUIDs
# Build a hash table with group GUIDs
$groupGuidsToCheck = New-Object "System.Collections.Generic.HashSet[Guid]"
foreach ($groupDN in $groupDNs)
{
$group = $Context.BindToObjectByDN($groupDN)
$groupGuid = $group.Get("objectGuid")
[void]$groupGuidsToCheck.Add($groupGuid)
}
# Get GUIDs of the groups the user is a member of
$targetGroupGuids = New-Object "System.Collections.Generic.HashSet[Guid]"
try
{
$Context.TargetObject.GetEx("adm-MemberOfGuid") | %%{[void]$targetGroupGuids.Add([Guid]$_)}
}
catch
{
return # The user is not a member of any groups.
}
foreach ($guid in $groupGuidsToCheck)
{
# Check whether the target object is a member of the groups in list
if ($targetGroupGuids.Contains($guid))
{
continue
}
return # The user is not a member of all the groups that are in the list.
}
# User is a member of all the groups that are in the list.
$Context.ConditionIsMet = $TrueScript 2: Return true if the target object is a member of at least one group
$groupDNs = @(
"CN=Group 1,OU=Groups,DC=company,DC=com",
"CN=Group 2,OU=Groups,DC=company,DC=com",
"CN=Group 3,OU=Groups,DC=company,DC=com",
"CN=Group 4,OU=Groups,DC=subdomain.DC=company,DC=com")
$Context.ConditionIsMet = $False
# Get the group GUIDs
# Build a hash table with group GUIDs
$groupGuidsToCheck = New-Object "System.Collections.Generic.HashSet[Guid]"
foreach ($groupDN in $groupDNs)
{
$group = $Context.BindToObjectByDN($groupDN)
$groupGuid = $group.Get("objectGuid")
[void]$groupGuidsToCheck.Add($groupGuid)
}
# Get GUIDs of the groups the user is a member of
$targetGroupGuids = New-Object "System.Collections.Generic.HashSet[Guid]"
try
{
$Context.TargetObject.GetEx("adm-MemberOfGuid") | %%{[void]$targetGroupGuids.Add([Guid]$_)}
}
catch
{
return # The user is not a member of any groups.
}
foreach ($guid in $groupGuidsToCheck)
{
# Check whether the target object is a member of the groups in list
if ($targetGroupGuids.Contains($guid))
{
# User is a member of at least one of the groups.
$Context.ConditionIsMet = $True
return
}
}
Comments 0
You must be signed in to comment.