Password Self-Service enrollment

Question

I am attempting to write a powershell script that will enroll users in the self-service password system. However I would like to execute the new enrollment only if the user is not currently enrolled.

This example gets me part of the way..
http://www.adaxes.com/tutorials_SelfSer ... dReset.htm

Import-Module Adaxes

  $question1 = "What are the last 4 digits of your credit card?"
  $question2 = "What is your social security number?"

  foreach ($line in (Import-Csv c:\qa.csv))
  {
    $answer1 = $line.CardDigits
    $answer2 = $line.SSN

    # I would love an if statement here checking if user is already enrolled.
    New-AdmPasswordSelfServiceEnrollment $line.User -QuestionsAndAnswers @{$question1=$answer1;$question2=$answer2} -AdaxesService localhost
  }

Reviewing the SDK points at an adsi method within IAdmPasswordSelfServiceReportRecord called GetUserInfo that appears to have the information I require. I am not sure how to use this in PowerShell, there are no examples within that section of the SKD

# ... a bunch of code up above that queries a SQL database and returns $results and sets variables
foreach ($result in $results) {
$userObj = get-ADUser $result.Identity -Properties CanonicalName,sAMAccountName,distinguishedName
[Reflection.Assembly]::LoadWithPartialName("Softerra.Adaxes.Adsi")
$admNS = New-Object "Softerra.Adaxes.Adsi.AdmNamespace"
$admService = $admNS.GetServiceDirectly($AdaxesService)
$admUser = $admService.OpenObject(("Adaxes://" + $userObj.DistinguishedName), $NULL, $NULL, 0)

# i dont quite know what to put here...
if ( $admUser... ? -eq $false ) {
New-AdmPasswordSelfServiceEnrollment -Identity $result.Identity -QuestionsAndAnswers @{$question1=$pin;$question2=$result.DateOfBirth} -AdaxesService $AdaxesService
}
}

oh, and if New-admPasswordSelfServiceEnrollment command only "does anything" if there is no enrollment that would be great, but the system keeps re-enrolling every time I send the command.

I would love some assistance, thank you

Answer 1

Hello David,

To determine whether a user is enrolled, you can use ADSI interfaces. The IAdmPasswordSelfServiceOps::IsEnrolled property exposed by each AD user in Adaxes indicates whether a user is enrolled for Password Self-Service.

How do you plan to launch the script, as a part of an Adaxes Scheduled Task or directly from the Windows PowerShell Console, for example?

if New-admPasswordSelfServiceEnrollment command only "does anything" if there is no enrollment that would be great

Actually, the current behavior of the cmdlet was done on purpose, because Password Self-Service Policies can change, as well as user data can change, so you may need to re-enroll a user with other Password Self-Service parameters. For this purpose, the cmdlet always re-enrolls users.

Comments

Support Thank you.

omg, it is really that easy. /sigh

if ($admUser.IsEnrolled) { ... } 

The database that contains our "answers" is only available from specific machines, the adaxes server is no one of them. I will be scheduling a powershell script on a server that does have access to the data. This server as the adaxes powershell components installed.

---

David,

Actually, it won't be that simple. The thing is that the built-in $Context variable is only available in scripts run by Adaxes Business Rules, Custom Commands or Scheduled Tasks. It represents the script runtime context. Since you are going to run the script outside of Adaxes, you'll first need to connect to your Adaxes service. Here's a version of the script that'll do the job:

Import-Module Adaxes
[Reflection.Assembly]::LoadWithPartialName("Softerra.Adaxes.Adsi")

$serviceAddress = "adaxesserver.example.com" # TODO: modify me
$cSVFilePath = "c:\qa.csv" # TODO: modify me

$question1 = "What are the last 4 digits of your credit card?" # TODO: modify me
$question2 = "What is your social security number?" # TODO: modify me

# Connect to Adaxes service
$admNS = New-Object "Softerra.Adaxes.Adsi.AdmNamespace"
$admService = $admNS.GetServiceDirectly($serviceAddress)

foreach ($line in (Import-Csv $cSVFilePath))
{
    # Find the user in AD
    $user = Get-AdmUser $line.User -ErrorAction SilentlyContinue

    if (-not($user))
    {
        $userId = $line.User
        Write-Host "Could not find user with identity $userId"
        continue
    }

    # Bind to the user
    $userDN = $user.DistinguishedName
    $userObj = $admService.OpenObject("Adaxes://$userDN", $NULL, $NULL, 0)

    if (-not($userObj.IsEnrolled))
    {
        $answer1 = $line.CardDigits
        $answer2 = $line.SSN

        New-AdmPasswordSelfServiceEnrollment $user -QuestionsAndAnswers @{$question1=$answer1;$question2=$answer2} -AdaxesService $serviceAddress
     }   
}