CLI: How to modify approvers list for existing rule

Question

I am attempting to update a business rule using PowerShell to include additional approves. This is what I have so far

$account = "username"

# Connect to the Adaxes service
$admNS = New-Object "Softerra.Adaxes.Adsi.AdmNamespace"
$admService = $admNS.GetServiceDirectly("localhost")

# Connect to Business Role Object
$businessRolesPath = $admService.Backend.GetConfigurationContainerPath("AccessControlRoles")
$businessRolesPathObj = New-Object "Softerra.Adaxes.Adsi.AdsPath" $businessRolesPath
$businessRoleObj = $businessRolesPathObj.CreateChildPath( "CN=Account Manager")
$businessRole = $admService.OpenObject($businessRoleObj, $NULL, $NULL, 0)

# Create Business Role Assignment
$businessRoleAssignment = $businessRole.Assignments.Create()
$businessRoleAssignment.Trustee = "DOMAIN\" + $account
$businessRoleAssignment.SetInfo()
$businessRole.Assignments.Add($businessRoleAssignment)

# Connect to Business Unit Object
$businessUnitsPath = $admService.Backend.GetConfigurationContainerPath("BusinessUnits")
$businessUnitsPathObj = New-Object "Softerra.Adaxes.Adsi.AdsPath" $businessUnitsPath
$businessUnitAdsPath = $businessUnitsPathObj.CreateChildPath("CN=" + $Department + ",CN=Departments")
$businessUnitObj = $admService.OpenObject($businessUnitAdsPath, $NULL, $NULL, 0)

# Apply Scope to Business Role
$businessRoleScope = $businessRoleAssignment.ActivityScopeItems.Create()
$businessRoleScope.BaseObject = $businessUnitObj
$businessRoleScope.Type = "ADM_SCOPEBASEOBJECTTYPE_BUSINESSUNIT"
$businessRoleScope.Inheritance = "ADS_SCOPE_SUBTREE"
$businessRoleScope.Exclude = $False
$businessRoleScope.SetInfo()
$businessRoleAssignment.ActivityScopeItems.Add($businessRoleScope)

# Connect to Business Rule Object
$businessRulesPath = $admService.Backend.GetConfigurationContainerPath("BusinessRules")
$businessRulesPathObj = New-Object "Softerra.Adaxes.Adsi.AdsPath" $businessRulesPath
$businessRuleAdsPath = $businessRulesPathObj.CreateChildPath("CN=" + $Department + " Group Rule,CN=Departments")
$businessRuleObj = $admService.OpenObject($businessRuleAdsPath, $NULL, $NULL, 0)

After that I have this code:

$actionsAndConditions = $businessRuleObj.ConditionedActions
$approvalAction = $actionsAndConditions.GetAction() | ?{$_.ApproversInfo}
$approvalUser = $admService.OpenObject("Adaxes://" + $user.DistinguishedName, $NULL, $NULL, 0)
$approvalAction.ApproversInfo.ApproverTrustees.Add($approvalUser)

At this point I can access the object and get the correct number of ApproverTrustees.

$approvalAction.ApproversInfo.ApproverTrustees.Count

But I'm unable to save it (SetInfo). I think I am not defining something correctly in the second code block. Any assistance would be appreciated.

(love the powershell!)

Answer 1

Hello,

The 1st part of your code looks OK, however the 2nd part doesn't seem to be functional at all.

To locate an action that creates an Approval Request, you need to iterate through all the sets of actions and conditions of the Business Rule. In each set, you need to check whether an action performs an operation of the "approval request info" type. Here's a script that does what you need. Replace the 2nd part of your script with this code.

$approvalUser = $admService.OpenObject("Adaxes://" + $user.DistinguishedName, $NULL, $NULL, 0)
foreach ($actionsAndConditions in $businessRuleObj.ConditionedActions)
{
    $actions = $actionsAndConditions.Actions
    foreach ($action in $actions)
    {
        $actionObj = $action.GetAction()
        if (($actionObj.IsOperationOfType($NULL, "approval request info")) -and (-not($actionObj.ApproversInfo.IsApprover($approvalUser, $NULL))))
        {
            $actionObj.ApproversInfo.ApproverTrustees.Add($approvalUser)
            $action.SetAction($actionObj)
            $action.SetInfo()
        }
    }
}

Comments

Yes - that 2nd part was certainly not working.

Thank you!