copy groups from one user to another

Question

goal is to copy groups from one user to another during the crete user process.

I created a variable on the create user form to input the UPN of the source user

i refernce that in the script to get the groups this source user is a member of here is the script. below is also they error.

$sourceUserDNParamName =  "%adm-CustomAttributeText36%" # TODO: modify me
$replaceGroups = $True # TODO: modify me

# Bind to the source user
#$sourceUserDN = $Context.GetParameterValue($sourceUserDNParamName)
$sourceUser =  $Context.BindToObjectByDNEx("$sourceUserDNParamName", $True)

# Get groups to add
$groupGuidsToAdd = New-Object "System.Collections.Generic.HashSet[System.Guid]"
$sourceUser.GetEx("adm-DirectMemberOfGuid") | %%{[void]$groupGuidsToAdd.Add([Guid]$_)}

# Get current groups
$currentGroupGuids = New-Object "System.Collections.Generic.HashSet[System.Guid]"
$Context.TargetObject.GetEx("adm-DirectMemberOfGuid") | %%{[void]$currentGroupGuids.Add([Guid]$_)}

# Update groups
foreach ($guidBytes in $groupGuidsToAdd)
{
    $guid = [Guid]$guidBytes
    if ($currentGroupGuids.Remove($guid))
    {
        continue
    }

    $group = $Context.BindToObjectEx("Adaxes://<GUID=$guid>", $True)
    $group.Add($Context.TargetObject.AdsPath)
}

if ($replaceGroups)
{
    # Get the primary group ID
    $primaryGroupId = $Context.TargetObject.Get("primaryGroupID")

    foreach ($guidBytes in $currentGroupGuids)
    {
        $guid = [Guid]$guidBytes
        $group = $Context.BindToObjectEx("Adaxes://<GUID=$guid>", $True)

        # Skip the group if it is the user's Primary Group
        if ($group.Get("primaryGroupToken") -eq $primaryGroupId)
        {
            continue
        }

        $group.Remove($Context.TargetObject.AdsPath)
    }
}

Answer 1

Hello Derek,

Do we understand correctly that you are creating a user via a custom command? If this is the case, you need to use an AD object picker parameter in the custom command and specify the name of the parameter in the $sourceUserDNParamName variable in the script. For more details about configuring custom commands, please see this tutorial. Please, pay attention to the How to use parameters section on step 4.

Comments

No i am using a business rule after the user is created

---

Thank you for clarifying. In this case, you need to use the second script from this article (the one labelled Using a DN syntax property). The script must be executed directly in a Run a program or PowerShell script action in a business rule triggering After creating a user. You can update the script to perform the membership update via the Adaxes pipeline just like you did with your current script - by using the BindToObjectByDNEx method and setting the Pipelined parameter to $True instead of simply using BindToObjectByDN.

Also, the user creation form must have a DN syntax property (e.g. the Assistant property) for source user selection, instead of a text property. This is actually what is causing the error right now. The script attempts to bind to the source user by their UPN specified in the text field, while it is possible to bind to an object only using a DN, GUID, or SID.

---

how do i do this?

Also, the user creation form must have a DN syntax property (e.g. the Assistant property) for source user selection, instead of a text property. This is actually what is causing the error right now

---

For details on how to customize forms for user creation, please see this tutorial. You need to add one of the following DN syntax properties to the form:

• Assistant
• Secretary
• See also

Pick one that you don't use for other purposes. You can also change the display name of the property to something more friendly, e.g. Source user. For details, see this help article.

During user creation, you will be able to use this field to select a user in your AD to copy group membership from.

---

Ok i figured that out, but i get this error:

Run PowerShell script 'Copy Groups' for the user Cannot find an overload for "BindToObjectByDNEx" and the argument count: "1". Stack trace: at <ScriptBlock>, <No file>: line 6 You cannot call a method on a null-valued expression. Stack trace: at <ScriptBlock>, <No file>: line 10

---

It looks like you replaced the BindToObjectByDN method in the script with the BindToObjectByDNEx method, but didn't add the second parameter which controls whether Adaxes will bind to the object using the pipeline or not.

If you need to bind to the source user via the Adaxes pipeline, the line 6 in the script should look like this:

$sourceUser = $Context.BindToObjectByDNEx($sourceUserDN, $True)

For more details about using the BindToObjectByDNEx method, please see this article in our SDK.

---

That solved that error, but i know getr this error:

Run PowerShell script 'Copy Groups' for the user Exception calling "Add" with "1" argument(s): "This operation requires approval." Stack trace: at <ScriptBlock>, <No file>: line 26

Line 26: $group.Add($Context.TargetObject.AdsPath)

the groups are added though

---

This message occurs because the operation that adds a new group member is sent for approval, probably by a business rule that triggers Before adding a member to a group. You can safely ignore this message.

If you want to git rid of it in the execution log, you can modify the script to catch the exception and suppress it. To do this, replace the $group.Add($Context.TargetObject.AdsPath) line with the following code:

try
{
    $group.Add($Context.TargetObject.AdsPath)
}
catch
{
    if ($Context.IsApprovalRequiredException($_.Exception))
    {
        continue
    }
    else
    {
        throw
    }
}

---

That worked! Thanks!