@ -2,6 +2,8 @@
# This file is part of Ansible
#
# Copyright 2015, Phil Schwartz <schwartzmx@gmail.com>
# Copyright 2015, Trond Hindenes
# Copyright 2015, Hans-Joachim Kliemeck <git@kliemeck.de>
#
# Ansible is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
@ -25,141 +27,96 @@
#Functions
Function UserSearch
{
Param ( [ string ] $ A ccountName)
Param ( [ string ] $ a ccountName)
#Check if there's a realm specified
if ( $AccountName . Split ( " \ " ) . count -gt 1 )
$searchDomain = $false
$searchDomainUPN = $false
if ( $accountName . Split ( " \ " ) . count -gt 1 )
{
if ( $AccountName . Split ( " \ " ) [ 0 ] -eq $env:COMPUTERNAME )
if ( $ a ccountName. Split ( " \ " ) [ 0 ] - n e $env:COMPUTERNAME )
{
$IsLocalAccount = $true
$searchDomain = $true
$accountName = $accountName . split ( " \ " ) [ 1 ]
}
Else
{
$IsDomainAccount = $true
$IsUpn = $false
}
}
Elseif ( $ AccountName -contains " @ " )
Elseif ( $accountName . contains ( " @ " ) )
{
$ I sDomainAccount = $true
$ IsUpn = $true
$searchDomain = $true
$searchDomainUPN = $true
}
Else
{
#Default to local user account
$accountname = $env:COMPUTERNAME + " \ " + $AccountName
$IsLocalAccount = $true
$accountName = $env:COMPUTERNAME + " \ " + $accountName
}
if ( $IsLocalAccount -eq $true )
if ( $searchDomain -eq $false )
{
$localaccount = get-wmiobject -class " Win32_UserAccount " -namespace " root\CIMV2 " -filter " (LocalAccount = True) " | where { $_ . Caption -eq $AccountName }
# do not use Win32_UserAccount, because e.g. SYSTEM (BUILTIN\SYSTEM or COMPUUTERNAME\SYSTEM) will not be listed. on Win32_Account groups will be listed too
$localaccount = get-wmiobject -class " Win32_Account " -namespace " root\CIMV2 " -filter " (LocalAccount = True) " | where { $_ . Caption -eq $accountName }
if ( $localaccount )
{
return $localaccount . Caption
}
$LocalGroup = get-wmiobject -class " Win32_Group " -namespace " root\CIMV2 " -filter " LocalAccount = True " | where { $_ . Caption -eq $AccountName }
if ( $LocalGroup )
{
return $LocalGroup . Caption
return $localaccount . SID
}
}
Else If ( ( $IsDomainAccount -eq $true ) -and ( $IsUpn -eq $false ) )
Else
{
#Search by samaccountname
$Searcher = [ adsisearcher ] " "
$Searcher . Filter = " sAMAccountName= $( $accountname . split ( " \ " ) [ 1 ] ) "
$result = $Searcher . FindOne ( )
If ( $searchDomainUPN -eq $false ) {
$Searcher . Filter = " sAMAccountName= $( $accountName ) "
}
Else {
$Searcher . Filter = " userPrincipalName= $( $accountName ) "
}
$result = $Searcher . FindOne ( )
if ( $result )
{
return $accountname
$user = $result . GetDirectoryEntry ( )
# get binary SID from AD account
$binarySID = $user . ObjectSid . Value
# convert to string SID
return ( New-Object System . Security . Principal . SecurityIdentifier ( $binarySID , 0 ) ) . Value
}
}
}
$params = Parse-Args $args ;
$result = New-Object psobject @ {
win_acl = New-Object psobject
changed = $false
}
If ( $params . path ) {
$path = $params . path . toString ( )
If ( -Not ( Test-Path -Path $path ) ) {
Fail-Json $result " $path file or directory does not exist on the host "
}
}
Else {
Fail-Json $result " missing required argument: path "
}
If ( $params . user ) {
$user = UserSearch -AccountName ( $Params . User )
# Test that the user/group is resolvable on the local machine
if ( ! $user )
{
Fail-Json $result " $( $Params . User ) is not a valid user or group on the host machine or domain "
}
}
Else {
Fail-Json $result " missing required argument: user. specify the user or group to apply permission changes. "
}
If ( $params . type -eq " allow " ) {
$type = $true
}
ElseIf ( $params . type -eq " deny " ) {
$type = $false
}
Else {
Fail-Json $result " missing required argument: type. specify whether to allow or deny the specified rights. "
}
If ( $params . inherit ) {
# If it's a file then no flags can be set or an exception will be thrown
If ( Test-Path -Path $path -PathType Leaf ) {
$inherit = " None "
}
Else {
$inherit = $params . inherit . toString ( )
}
}
Else {
# If it's a file then no flags can be set or an exception will be thrown
If ( Test-Path -Path $path -PathType Leaf ) {
$inherit = " None "
}
Else {
$inherit = " ContainerInherit, ObjectInherit "
}
}
If ( $params . propagation ) {
$propagation = $params . propagation . toString ( )
}
Else {
$propagation = " None "
}
If ( $params . rights ) {
$rights = $params . rights . toString ( )
$result = New-Object PSObject ;
Set-Attr $result " changed " $false ;
$path = Get-Attr $params " path " -failifempty $true
$user = Get-Attr $params " user " -failifempty $true
$rights = Get-Attr $params " rights " -failifempty $true
$type = Get-Attr $params " type " -failifempty $true -validateSet " allow " , " deny " -resultobj $result
$state = Get-Attr $params " state " " present " -validateSet " present " , " absent " -resultobj $result
$inherit = Get-Attr $params " inherit " " "
$propagation = Get-Attr $params " propagation " " None " -validateSet " None " , " NoPropagateInherit " , " InheritOnly " -resultobj $result
If ( -Not ( Test-Path -Path $path ) ) {
Fail-Json $result " $path file or directory does not exist on the host "
}
# Test that the user/group is resolvable on the local machine
$sid = UserSearch -AccountName ( $user )
if ( ! $sid )
{
Fail-Json $result " $user is not a valid user or group on the host machine or domain "
}
Else {
Fail-Json $result " missing required argument: rights "
If ( Test-Path -Path $path -PathType Leaf ) {
$inherit = " None "
}
If ( $params . state -eq " absent " ) {
$state = " remove "
}
Else {
$state = " add "
ElseIf ( $inherit -eq " " ) {
$inherit = " ContainerInherit, ObjectInherit "
}
Try {
@ -167,41 +124,42 @@ Try {
$InheritanceFlag = [ System.Security.AccessControl.InheritanceFlags ] $inherit
$PropagationFlag = [ System.Security.AccessControl.PropagationFlags ] $propagation
If ( $type ) {
If ( $type -eq " allow " ) {
$objType = [ System.Security.AccessControl.AccessControlType ] :: Allow
}
Else {
$objType = [ System.Security.AccessControl.AccessControlType ] :: Deny
}
$objUser = New-Object System . Security . Principal . NTAccount( $user )
$objUser = New-Object System . Security . Principal . SecurityIdentifier( $sid )
$objACE = New-Object System . Security . AccessControl . FileSystemAccessRule ( $objUser , $colRights , $InheritanceFlag , $PropagationFlag , $objType )
$objACL = Get-ACL $path
# Check if the ACE exists already in the objects ACL list
$match = $false
ForEach ( $rule in $objACL . Access ) {
If ( ( $rule . FileSystemRights -eq $objACE . FileSystemRights ) -And ( $rule . AccessControlType -eq $objACE . AccessControlType ) -And ( $rule . IdentityReference -eq $objACE . IdentityReference ) -And ( $rule . IsInherited -eq $objACE . IsInherited ) -And ( $rule . InheritanceFlags -eq $objACE . InheritanceFlags ) -And ( $rule . PropagationFlags -eq $objACE . PropagationFlags ) ) {
$ruleIdentity = $rule . IdentityReference . Translate ( [ System.Security.Principal.SecurityIdentifier ] )
If ( ( $rule . FileSystemRights -eq $objACE . FileSystemRights ) -And ( $rule . AccessControlType -eq $objACE . AccessControlType ) -And ( $ruleIdentity -eq $objACE . IdentityReference ) -And ( $rule . IsInherited -eq $objACE . IsInherited ) -And ( $rule . InheritanceFlags -eq $objACE . InheritanceFlags ) -And ( $rule . PropagationFlags -eq $objACE . PropagationFlags ) ) {
$match = $true
Break
}
}
If ( $state -eq " add " -And $match -eq $false ) {
If ( $state -eq " present " -And $match -eq $false ) {
Try {
$objACL . AddAccessRule ( $objACE )
Set-ACL $path $objACL
$result . changed = $true
Set-Attr $result " changed " $true ;
}
Catch {
Fail-Json $result " an exception occured when adding the specified rule "
}
}
ElseIf ( $state -eq " remove " -And $match -eq $true ) {
ElseIf ( $state -eq " absent " -And $match -eq $true ) {
Try {
$objACL . RemoveAccessRule ( $objACE )
Set-ACL $path $objACL
$result . changed = $true
Set-Attr $result " changed " $true ;
}
Catch {
Fail-Json $result " an exception occured when removing the specified rule "
@ -222,4 +180,4 @@ Catch {
Fail-Json $result " an error occured when attempting to $state $rights permission(s) on $path for $user "
}
Exit-Json $result
Exit-Json $result
Brian Coca
9 years ago