Hello,
We are looking to change the task to scan all users and only allow the specified employee types to be added and all else will be removed. is the screenshot below an accurate way to achieve this?
The appropriate way to achieve what you want is using a regular expression to check if the user has to be a member of the group and validate the user group membership.
To create the Scheduled Task:
- Launch Adaxes Administration Console.
- Right-click your Adaxes service node, navigate to New and click Scheduled Task.
- On step 3 of the Create Scheduled Task wizard, select User Object type and click Next.
- Click Add an action.
- Select Add the User to a group.
- In the Add the user to field, specify the group the user has to be added to.
- Click OK.
- Right-click the action you created and then click Add Condition.
- Select If <property> <relation> <value>.
- Select If Employee Type matches regexp and enter the following regular expression in the last field:
^(50301|50270|50230|50232|50210|50211|50220|50221|50280|50304|50303)$
- Click OK.
- Right-click the action you created and click Add Condition again.
- Select If is a member of <Group>.
- Select If the User is not a member of and specify the group the user has to be added to.
- Click OK.
- Right-click the set of actions and conditions you created and click Copy.
- Press Ctrl+V.
- In the Else If block, right-click the If Employee Type matches regexp condition and click Edit Condition.
- Select does not match regexp and click OK.
- Right-click the If is not a member of condition and click Edit Condition.
- Select If the User is member of and click OK.
- Right-click the Add the User to a group action and click Edit Action.
- Select Remove the User from a group.
- In the Remove the user from field, specify the group the user has to be removed from.
- Click OK.
- Click Next and finish creating the Scheduled Task. The task should look like the following:
We would like to stop the user from even be added outside of this task altogether. Any ideas?
To prevent users with inappropriate Employee Type from being added to a group, you need to use a Business Rule triggering Before Adding a member to a Group. In the rule, a script condition will check the member’s Employee Type. If the value of the Employee Type is absent in the list of allowed values, adding to the group will be cancelled. To create the Business Rule:
-
Launch Adaxes Administration Console.
-
Right-click your Adaxes service node, navigate to New and click Business Rule.
-
On step 2 of the Create Business Rule wizard, select Group Object type.
-
Select Before Adding a member to a Group and click Next.
-
Click Add an action and select Cancel this operation.
Optionally, you can specify a Reason for the operation cancellation.
-
Click OK.
-
Right-click the action you created and click Add Condition.
-
Select If PowerShell script returns true.
-
Paste the following script into the Script field. In the script:
- $attributeName – specifies the LDAP name of the property that stores a value for comparison (i.e. employeeType);
- $employeeTypeValues – specifies the list of allowed values.
$attributeName = "employeeType" # TODO: modify me
$employeeTypeValues = @("50301", "50270", "50230", "50232", "50210", "50211", "50220", "50221", "50280", "50304", "50303") # TODO: modify me
$Context.ConditionIsMet = $True
$member = $Context.BindToObject("Adaxes://%member%")
try
{
$value = $member.Get($attributeName)
}
catch
{
return
}
$Context.ConditionIsMet = $employeeTypeValues -notcontains $value
-
Click OK.
-
Click Next and finish creating the Business Rule. You should have something like the following:
