From 05e01bd3b50404371a8f9ee1128ff08925e8b906 Mon Sep 17 00:00:00 2001 From: Phil Date: Tue, 14 Jul 2015 18:35:28 -0500 Subject: [PATCH] updates user search verification for local/domain - Thanks to @trondhindenes for implementing this strategy - also updated documentation --- windows/win_acl.ps1 | 110 ++++++++++++++++++++++++++++++++++---------- windows/win_acl.py | 4 +- 2 files changed, 87 insertions(+), 27 deletions(-) diff --git a/windows/win_acl.ps1 b/windows/win_acl.ps1 index 39530866c61..ec72828a531 100644 --- a/windows/win_acl.ps1 +++ b/windows/win_acl.ps1 @@ -15,21 +15,82 @@ # # You should have received a copy of the GNU General Public License # along with Ansible. If not, see . - + # WANT_JSON # POWERSHELL_COMMON - + # win_acl module (File/Resources Permission Additions/Removal) + + +#Functions +Function UserSearch +{ + Param ([string]$AccountName) + #Check if there's a realm specified + if ($AccountName.Split("\").count -gt 1) + { + if ($AccountName.Split("\")[0] -eq $env:COMPUTERNAME) + { + $IsLocalAccount = $true + } + Else + { + $IsDomainAccount = $true + $IsUpn = $false + } + + } + Elseif ($AccountName -contains "@") + { + $IsDomainAccount = $true + $IsUpn = $true + } + Else + { + #Default to local user account + $accountname = $env:COMPUTERNAME + "\" + $AccountName + $IsLocalAccount = $true + } + + + if ($IsLocalAccount -eq $true) + { + $localaccount = get-wmiobject -class "Win32_UserAccount" -namespace "root\CIMV2" -filter "(LocalAccount = True)" | where {$_.Caption -eq $AccountName} + if ($localaccount) + { + return $localaccount.Caption + } + $LocalGroup = get-wmiobject -class "Win32_Group" -namespace "root\CIMV2" -filter "LocalAccount = True"| where {$_.Caption -eq $AccountName} + if ($LocalGroup) + { + return $LocalGroup.Caption + } + } + ElseIf (($IsDomainAccount -eq $true) -and ($IsUpn -eq $false)) + { + #Search by samaccountname + $Searcher = [adsisearcher]"" + $Searcher.Filter = "sAMAccountName=$($accountname.split("\")[1])" + $result = $Searcher.FindOne() + + if ($result) + { + return $accountname + } + } + +} + $params = Parse-Args $args; - + $result = New-Object psobject @{ win_acl = New-Object psobject changed = $false } - + If ($params.src) { $src = $params.src.toString() - + If (-Not (Test-Path -Path $src)) { Fail-Json $result "$src file or directory does not exist on the host" } @@ -37,21 +98,20 @@ If ($params.src) { Else { Fail-Json $result "missing required argument: src" } - + If ($params.user) { - $user = $params.user.toString() - - # Test that the user/group exists on the local machine - $localComputer = [ADSI]("WinNT://"+[System.Net.Dns]::GetHostName()) - $list = ($localComputer.psbase.children | Where-Object { (($_.psBase.schemaClassName -eq "User") -Or ($_.psBase.schemaClassName -eq "Group"))} | Select-Object -expand Name) - If (-Not ($list -contains "$user")) { - Fail-Json $result "$user is not a valid user or group on the host machine" - } + $user = UserSearch -AccountName ($Params.User) + + # Test that the user/group is resolvable on the local machine + if (!$user) + { + Fail-Json $result "$($Params.User) is not a valid user or group on the host machine or domain" + } } Else { Fail-Json $result "missing required argument: user. specify the user or group to apply permission changes." } - + If ($params.type -eq "allow") { $type = $true } @@ -61,7 +121,7 @@ ElseIf ($params.type -eq "deny") { Else { Fail-Json $result "missing required argument: type. specify whether to allow or deny the specified rights." } - + If ($params.inherit) { # If it's a file then no flags can be set or an exception will be thrown If (Test-Path -Path $src -PathType Leaf) { @@ -80,44 +140,44 @@ Else { $inherit = "ContainerInherit, ObjectInherit" } } - + If ($params.propagation) { $propagation = $params.propagation.toString() } Else { $propagation = "None" } - + If ($params.rights) { $rights = $params.rights.toString() } Else { Fail-Json $result "missing required argument: rights" } - + If ($params.state -eq "absent") { $state = "remove" } Else { $state = "add" } - + Try { $colRights = [System.Security.AccessControl.FileSystemRights]$rights $InheritanceFlag = [System.Security.AccessControl.InheritanceFlags]$inherit $PropagationFlag = [System.Security.AccessControl.PropagationFlags]$propagation - + If ($type) { $objType =[System.Security.AccessControl.AccessControlType]::Allow } Else { $objType =[System.Security.AccessControl.AccessControlType]::Deny } - + $objUser = New-Object System.Security.Principal.NTAccount($user) $objACE = New-Object System.Security.AccessControl.FileSystemAccessRule ($objUser, $colRights, $InheritanceFlag, $PropagationFlag, $objType) $objACL = Get-ACL $src - + # Check if the ACE exists already in the objects ACL list $match = $false ForEach($rule in $objACL.Access){ @@ -126,7 +186,7 @@ Try { Break } } - + If ($state -eq "add" -And $match -eq $false) { Try { $objACL.AddAccessRule($objACE) @@ -161,5 +221,5 @@ Try { Catch { Fail-Json $result "an error occured when attempting to $state $rights permission(s) on $src for $user" } - + Exit-Json $result \ No newline at end of file diff --git a/windows/win_acl.py b/windows/win_acl.py index 96cfc5751b9..b3ddcce7ac8 100644 --- a/windows/win_acl.py +++ b/windows/win_acl.py @@ -24,7 +24,7 @@ DOCUMENTATION = ''' --- module: win_acl -version_added: "" +version_added: "2.0" short_description: Set file/directory permissions for a system user or group. description: - Add or remove rights/permissions for a given user or group for the specified src file or folder. @@ -107,7 +107,7 @@ options: - InheritOnly default: "None" aliases: [] -author: Phil Schwartz +author: Phil Schwartz, Trond Hindenes ''' EXAMPLES = '''