Following from my previous post on how to create a group with both static members and dynamic filter, I came across a scenario where post migration we have some customers who initially had a group with explicit members but we thought they could be converted to a filter based group which matches the business case.
The script below helps you on doing the same. Again using LithnetRMA for the process.
Warning: Again, many custom attributes logic in FIMService for my environment but again you will get the whole idea. I have left the script as-is and not dumbed it down.
Please read my Groups with Static and Dynamic Members in FIMService post to understand the logic I have been applying for Autogen groups and how group and set tie up to each other in FIMService.
LOGIC
- Asks for existing group name (DisplayName) in FIMService.
- If found, outputs the number of explicit members found
- Asks if you want to put a filter on the group and then asks for the XPATH filter (coming soon on how to create XPATH easily)
- Checks if the filter is valid. If so (the fun part)
- Outputs the count of users in the new filter
- Compares the filter users to explicit members and gives a count of
- New members to be added due to filter (i.e. not found in the explicit members list)
- Count of common members found between existing explicit members and XPATH
- Finally gives count of explicit members for the new set to be created (i.e. not found in the new filter).
- Finally if the user wants to continue after above information
- Creates a set with “Autogen-GroupName” and set the filter and explicit members to that
- Modify’s existing group and deletes the current explicit members
- Converts the existing group to a filter based and sets the objectID of the set created above.
- Done
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 |
Import-Module LithnetRMA Set-ResourceManagementClient -BaseAddress "http://YOUR-FIMSERVICE-ENDPOINT:5725" Function ModifyUserGroup($groupObjectID, $setObjectID) { $group = Get-Resource -ID $groupObjectID Write-Host "Deleting Group Explicit Members" -ForegroundColor Cyan $group.ExplicitMember = $null Write-Host "Changing accountType to AutogenGroup" -ForegroundColor Cyan $group.accountType = "AutogenGroup" Write-Host "Changing Group Type to Filter" -ForegroundColor Cyan $group.MembershipLocked = $true $group.MembershipAddWorkflow = "None" Write-Host "Adding Filter to Parent Group" -ForegroundColor Cyan $group.Filter = '<Filter xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Dialect="http://schemas.microsoft.com/2006/11/XPathFilterDialect" xmlns="http://schemas.xmlsoap.org/ws/2004/09/enumeration">/*[((ObjectType = "Person") or (ObjectType = "Group")) and (ObjectID = /Set[ObjectID ="' +$setObjectID+ '"]/ComputedMember)]</Filter>' $group.connectedSetObjectID = "$setObjectID" try { Write-Host "Modifying Parent Group:" $group.DisplayName -ForegroundColor Cyan Save-Resource $group } catch { Write-Warning ("Unable to modify group:" + $_.Exception.Message) exit } } Function CreateSet($groupObjectID, $groupDisplayName, $explicitmembers, $newfilter) { $set = New-Resource -ObjectType Set $set.DisplayName = "Autogen-" + $groupDisplayName $set.accountType = "AutogenSet" if ($newfilter) { $set.Filter = '<Filter xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Dialect="http://schemas.microsoft.com/2006/11/XPathFilterDialect" xmlns="http://schemas.xmlsoap.org/ws/2004/09/enumeration">' +$newfilter+ '</Filter>' } $set.connectedGroupObjectID = $groupObjectID foreach ($member in $explicitmembers) { $set.ExplicitMember.Add($member) | Out-Null } try { Write-Host "Creating new AutogenSet:" $set.DisplayName -ForegroundColor Cyan Save-Resource $set $setObjectID = Get-Resource -ObjectType Set -AttributeName DisplayName -AttributeValue $set.DisplayName return $setObjectID.ObjectID } catch { Write-Warning ("Unable to create set:" + $_.Exception.Message) exit } } Function CheckMembers($explicitmembers, $newfilter) { try { $filtermembers = Search-Resources -XPath "$newfilter" -AttributesToGet ObjectID } catch { $host.UI.WriteErrorLine("Bad Filter") continue } if ($filtermembers -eq $null) { $host.UI.WriteErrorLine("No Users found in new filter") continue } $compare = $explicitmembers | ?{$filtermembers.ObjectID.Value -notcontains $_} Write-Host "New Filter Members:" $filtermembers.ObjectID.Count -ForegroundColor Cyan Write-Host "Found Common Members Between New Filter & Existing Explicit Members:" ($explicitmembers.Count - $compare.Count) -ForegroundColor Cyan Write-Host "Total Explicit Members for New Set:" $compare.Count -ForegroundColor Cyan return $compare } Function ConvertStaticToAutogen() { $groupname = Read-Host -Prompt "Enter the static group name" $staticgroup = Search-Resources -XPath "/Group[(DisplayName = '$groupname')]" -AttributesToGet ExplicitMember, DisplayName, ObjectID, Filter -ErrorAction SilentlyContinue if ($staticgroup) { Write-Host "Found Group:" $staticgroup.DisplayName -ForegroundColor Cyan Write-Host "Current Explicit Members:" $staticgroup.ExplicitMember.Count -ForegroundColor Cyan if ($staticgroup.Filter) { $host.UI.WriteErrorLine("This groups has a filter") continue } $hasfilter = Read-Host -Prompt "Do you want to put a filter (y/n)" switch ($hasfilter) { y { $newfilter = Read-Host -Prompt "Enter the new filter for the group" $filter = $newfilter.Trim() $newexplicitmembers = CheckMembers ($staticgroup.ExplicitMember.Value) ($filter) } n { Write-Warning "No Filter given" $filter = $null } default { Write-Warning "Please input y or n only" exit } } $confirmcreation = Read-Host "Do you want to continue (y/n)" switch ($confirmcreation) { y { $newSetObjectID = CreateSet ($staticgroup.ObjectID) ($staticgroup.DisplayName) ($newexplicitmembers) ($filter) ModifyUserGroup ($staticgroup.ObjectID.Value) ($newSetObjectID.Value) Write-Host "Done!!!" -ForegroundColor Cyan } n { Write-Host "Exiting without creation" } default { Write-Warning "Please input y or n only" exit } } } else { $host.UI.WriteErrorLine("Group Not Found") continue } } ConvertStaticToAutogen |
Hope it helps.. Please like, share or leave a comment below..
