updates user search verification for local/domain

- Thanks to @trondhindenes for implementing this strategy
- also updated documentation
reviewable/pr18780/r1
Phil 9 years ago
parent dc84f05fed
commit 05e01bd3b5

@ -20,6 +20,67 @@
# POWERSHELL_COMMON # POWERSHELL_COMMON
# win_acl module (File/Resources Permission Additions/Removal) # win_acl module (File/Resources Permission Additions/Removal)
#Functions
Function UserSearch
{
Param ([string]$AccountName)
#Check if there's a realm specified
if ($AccountName.Split("\").count -gt 1)
{
if ($AccountName.Split("\")[0] -eq $env:COMPUTERNAME)
{
$IsLocalAccount = $true
}
Else
{
$IsDomainAccount = $true
$IsUpn = $false
}
}
Elseif ($AccountName -contains "@")
{
$IsDomainAccount = $true
$IsUpn = $true
}
Else
{
#Default to local user account
$accountname = $env:COMPUTERNAME + "\" + $AccountName
$IsLocalAccount = $true
}
if ($IsLocalAccount -eq $true)
{
$localaccount = get-wmiobject -class "Win32_UserAccount" -namespace "root\CIMV2" -filter "(LocalAccount = True)" | where {$_.Caption -eq $AccountName}
if ($localaccount)
{
return $localaccount.Caption
}
$LocalGroup = get-wmiobject -class "Win32_Group" -namespace "root\CIMV2" -filter "LocalAccount = True"| where {$_.Caption -eq $AccountName}
if ($LocalGroup)
{
return $LocalGroup.Caption
}
}
ElseIf (($IsDomainAccount -eq $true) -and ($IsUpn -eq $false))
{
#Search by samaccountname
$Searcher = [adsisearcher]""
$Searcher.Filter = "sAMAccountName=$($accountname.split("\")[1])"
$result = $Searcher.FindOne()
if ($result)
{
return $accountname
}
}
}
$params = Parse-Args $args; $params = Parse-Args $args;
$result = New-Object psobject @{ $result = New-Object psobject @{
@ -39,13 +100,12 @@ Else {
} }
If ($params.user) { If ($params.user) {
$user = $params.user.toString() $user = UserSearch -AccountName ($Params.User)
# Test that the user/group exists on the local machine # Test that the user/group is resolvable on the local machine
$localComputer = [ADSI]("WinNT://"+[System.Net.Dns]::GetHostName()) if (!$user)
$list = ($localComputer.psbase.children | Where-Object { (($_.psBase.schemaClassName -eq "User") -Or ($_.psBase.schemaClassName -eq "Group"))} | Select-Object -expand Name) {
If (-Not ($list -contains "$user")) { Fail-Json $result "$($Params.User) is not a valid user or group on the host machine or domain"
Fail-Json $result "$user is not a valid user or group on the host machine"
} }
} }
Else { Else {

@ -24,7 +24,7 @@
DOCUMENTATION = ''' DOCUMENTATION = '''
--- ---
module: win_acl module: win_acl
version_added: "" version_added: "2.0"
short_description: Set file/directory permissions for a system user or group. short_description: Set file/directory permissions for a system user or group.
description: description:
- Add or remove rights/permissions for a given user or group for the specified src file or folder. - Add or remove rights/permissions for a given user or group for the specified src file or folder.
@ -107,7 +107,7 @@ options:
- InheritOnly - InheritOnly
default: "None" default: "None"
aliases: [] aliases: []
author: Phil Schwartz author: Phil Schwartz, Trond Hindenes
''' '''
EXAMPLES = ''' EXAMPLES = '''

Loading…
Cancel
Save