Error adding Extended Rights to a Security Role (PowerShell)

Question

I'm using the example from the following SDK page:

http://www.adaxes.com/sdk/ManagingSecurityRoles.html

# Allow: Reset Password -> User
$entry = $role.Permissions.Create()

$userClassGuid = # the GUID of the User object class
    "{bf967aba-0de6-11d0-a285-00aa003049e2}"

$entry.AccessType = "ADM_PERMISSION_TYPE_ALLOW"
$entry.AccessMask = "ADS_RIGHT_DS_CONTROL_ACCESS"
$entry.ObjectType =
    [Softerra.Adaxes.Ldap.ExtendedRights]::UserForceChangePassword
$entry.InheritedObjectType = $userClassGuid

$entry.SetInfo() # save the permission entry
$role.Permissions.Add($entry) # add the permission to the role

I'm adding a couple other rights that are not Extended Rights above this in the script but I'm getting an error:

Unable to find type [Softerra.Adaxes.Ldap.ExtendedRights]. Make sure that the assembly that contains this type is loaded.
At line:76 char:1
+ $entry.ObjectType =
+ ~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (Softerra.Adaxes.Ldap.ExtendedRights:TypeName) [], RuntimeException
    + FullyQualifiedErrorId : TypeNotFound

Which is referring to this line:

$entry.ObjectType = [Softerra.Adaxes.Ldap.ExtendedRights]::UserForceChangePassword

Which I pulled right from the example. What am I missing here?

Thanks for any help you can provide

Answer 1

Hello,

The thing is that currently the ExtendedRights class is internal and cannot be used in scripts. By the next version, we'll make it public so that it can be called from external code. To workaround the issue for now, you need to specify the GUID of the necessary extended right explicitly. The GUID of the UserForceChangePassword right is {00299570-246d-11d0-a768-00aa006e0529}. The code will look like this:

# Allow: Reset Password -> User
$entry = $role.Permissions.Create()

$userClassGuid = # the GUID of the User object class
      "{bf967aba-0de6-11d0-a285-00aa003049e2}"
$extendedRightGuid = "{00299570-246d-11d0-a768-00aa006e0529}" # reset password

$entry.AccessType = "ADM_PERMISSION_TYPE_ALLOW"
$entry.AccessMask = "ADS_RIGHT_DS_CONTROL_ACCESS"
$entry.ObjectType = $extendedRightGuid
$entry.InheritedObjectType = $userClassGuid

$entry.SetInfo() # save the permission entry
$role.Permissions.Add($entry) # add the permission to the role

Comments

Thanks! That works perfect.