Adaxes force user to enter ticket number before adding or removing member from group

Question

Hello,

A year ago, in a previous ticket, I inquired about the possibility of mandating that Adaxes users enter a ticket number before adding a member to a group. At that time, it was feasible to add one group at a time but not multiple groups. I would like to confirm if this limitation still exists.

Additionally, I am curious if implementing this requirement would affect the automatic business rules that facilitate the addition/removal of members from groups.

Regards, Fabian

Comments

Hello Fabian,

Please, describe the configuration you have in all the possible details with live examples and screenshots. You can post the details here or send to us at support@adaxes.com.

---

I have business rules that automatically add users to groups upon user creation and remove users when the deprovision command is executed.

---

Hello Fabian,

Sorry for the confusion, but this does not describe anything about the process of adding a ticket number when modifying membership of a group. Business rule only trigger before or after an operation and perform the corresponding actions. They cannot request a user input.

---

I do not have it configured. I would only like to know if it is possible.

Answer 1

Hello Fabian,

Thank you for clarifying. It is possible using a custom command and two parameters. One parameter will be used to enter the ticket number, the other will be used to select the groups. In case of selecting multiple groups, a PowerShell script will be required for membership update. At the same time, there will be only a single ticket number for all the groups. In the logs, you will be able to see the ticket number as parameter value for the custom command execution.

Comments

If we want to set this up, I would need to revoke the write member property on all groups for all users. Am I right? They can still only add users to groups using the custom commands in groups where they have the appropriate permissions, correct?

---

Hello Fabian,

Yes, that is correct. They will only need the permissions to execute the custom command on the corresponding user accounts.

---

Can I also control with the custom command which groups users are permitted to add members to? Or will they be able to add members on all groups they can see?

---

Hello Fabian,

There are two points here as groups will be selected in a parameter:

• You can configure the parameter settings to only display groups that match certain criteria.
• No matter of the criteria configured for the parameter, users will only be able to see the groups they are allowed to see by Adaxes security roles.

---

and for adding devices to groups they can use the same button?

---

Hello Fabian,

If you mean computer objects, it will not work. A custom command can only be configured for a specific object type. As such, you will need a separate custom command for each object type.

---

Okey and for the revocation of groups I also would need a separate custom command for users and devices?

---

Hello Fabian,

Yes, that is correct.