Report to audit rule-based group query attributes

Question

We would like to be able to, possibly through a script or report, search for attributes that equal specific values and find all rule-based groups that used those rules.

An example would be providing the name of a company (e.g. Company = Contoso) and being able to list all rule-based groups that use that in their query set.

Comments

Hello,

Do we understand correctly that you want to select a property and a value for it which will result in providing the list of rule-based groups that use both to filter members? If that is correct, the report will look like the following: Does this meet your needs?

---

Hi,

We were actually able to determine the needed script to pull in the group filter data which resulted in a similar report to what you mentioned so this should be resolved.

For context, the below is what we used behind our report to successfully pull the correct groups when given a property name and value:

$membershipTypeProperty = "adm-GroupMembershipType"
$distinguishedNameProperty = "distinguishedName"
$filter = "(%param-PropertyName%=%param-PropertyValue%)"
try
{
    $Context.DirectorySearcher.SearchParameters.Filter = "(objectCategory=group)"

    # Add property necessary to generate the report
    $Context.DirectorySearcher.SearchParameters.PropertiesToLoad.Add($membershipTypeProperty)
    $Context.DirectorySearcher.SearchParameters.PropertiesToLoad.Add($distinguishedNameProperty)

    $searchResultIterator = $Context.DirectorySearcher.ExecuteSearch()
    while ($Context.MoveNext($searchResultIterator))
    {
        $searchResult = $searchResultIterator.Current
        $membershipType = [int]$searchResult.Properties[$membershipTypeProperty].Value
        if ($membershipType -eq 1)

        {
            [Reflection.Assembly]::LoadWithPartialName("Softerra.Adaxes.Adsi")

            # Connect to the Adaxes service
            $admNS = New-Object "Softerra.Adaxes.Adsi.AdmNamespace"
            $admService = $admNS.GetServiceDirectly("localhost")

            # Bind to the group
            $groupDN = $searchResult.GetPropertyByName("distinguishedName").Values[0]
            $group = $admService.OpenObject("Adaxes://$groupDN", $NULL, $NULL, 0)
            $rules = $group.MembershipRules

            foreach ($rule in $rules) {    
                if($rule.Type -eq "ADM_BUSINESSUNITMEMBERSHIPTYPE_QUERY") {
                    if($rule.Filter -match $filter) {
                       $Context.Items.Add($searchResult)
                       $Continue
                    } 
                }
            }
        }
    }
}
finally
{
    if ($searchResultIterator) 
    { 
        $searchResultIterator.Dispose()
    }
}

---

Update here - this method seems to no longer work with the 2023 change to criteria for rule-based groups.

Is there a way to still access the individual rules/criteria to allow for filtering to groups with a specific query parameter?

Answer 1

Hello,

Yes, below is the updated script.

$propertyName = "%param-PropertyName%"
$propertyValue = "%param-PropertyValue%"

try
{
    $groupCriteria = New-AdmCriteria -Type "group" -Expression {membershipType -eq "rule-based"}
    $Context.DirectorySearcher.AddCriteria($groupCriteria)

    $criteriaToCompare = New-AdmCriteria -Expression {$propertyName -eq $propertyValue}    
    $criteriaJsonToCompare = $criteriaToCompare.Item("*").Items.ToJson($null)
    $searchResultIterator = $Context.DirectorySearcher.ExecuteSearch()
    while ($Context.MoveNext($searchResultIterator))
    {
        $searchResult = $searchResultIterator.Current
        $group = $Context.BindToObjectBySearchResult($searchResult)

        foreach ($rule in $group.MembershipRules) 
        {
            if ($rule.Type -ne "ADM_BUSINESSUNITMEMBERSHIPTYPE_QUERY")
            {
                continue
            }

            $criteria = $rule.GetCriteria()
            if ($criteria.ToJson($NULL) | Select-String -Pattern $criteriaJsonToCompare -SimpleMatch)
            {
                $Context.Items.Add($searchResult)
                break
            }
        }
    }
}
finally
{
    if ($searchResultIterator) 
    { 
        $searchResultIterator.Dispose()
    }
}

Comments

Hi,

is it possible to execute this search also directly in PowerShell on the Adaxes server?

---

Hello,

No, the script can only be used to generate a report in Adaxes and cannot be modified to generate the same report in Windows PowerShell.

---

Ok, I tried to setup this report but no results are shown - I must have missed something^^

Under script I pasted the script above Then I tried this search

But not result is shown ... I would expect at least this group to be shown

---

Hello,

The behavior is expected as your parameter configuration is incorrect. The PropertyName parameter must be of the Property name picker type, not the Edit box one.

---

Woooooow ... yeah working now - THANKS!