Product: PowerShell Universal
Version: 2.8.1
I’m running PSU via IIS and using roles.ps1 to set access based on 3 AD groups that a person could be a member of:
- Admin
- Supervisor
- User
The code per New-PSURole section is like:
New-PSURole -Name "Admin" -Description "admin policy" -Policy {
param (
$User
)
$UserName = ($User.Identity.Name)
$UserDomain = $UserName.Split('\')[0]
$UserName = $UserName.Split('\')[1]
$UserServer = Switch ($UserDomain) {
'DDDD' {'domain.co.nz'}
'DDD2' {'domain2.co.nz'}
}
$requiredSIDmembership = 'S-1-5-21-123123123123-123123123-12345'
$UserSamAccountName = Get-ADUser -Identity $UserName -Server $UserServer | Select -ExpandProperty SamAccountName
$members = Get-ADGroupMember -Identity $requiredSIDmembership -Server 'domain.co.nz' -Recursive | Select -ExpandProperty SamAccountName
If ($members -contains $UserSamAccountName) {
$IsMember = $true
} Else {
$IsMember = $false
}
"$(Get-Date -f 'yyyy-MM-dd HH:mm:ss') PSURole -Name Admin IsMember: $IsMember" | Out-File "c:\temp\userConnectVar.txt" -append
# see PowerShell Universal admin: Automation|Variables to change this variable value
$userLoginsFolder = Get-UAVariable -Name 'UserLoginsFolder'
"ATTEMPTED ACCESS FROM: $($User.Identity.Name)" | Out-File "$userLoginsFolder\\$UserName.log"
"`r`nTo be in the 'Admin' role you need to be a member of SID: $requiredSIDmembership" | Out-File "$userLoginsFolder\\$UserName.log" -Append
"$($User.Identity.Name) is assigned to 'Admin' role: $IsMember" | Out-File "$userLoginsFolder\\$UserName.log" -Append
$IsMember
}
For this test, the user is a member of the 2 AD groups:
- Admin
- User
(they are not a member of the Supervisor group)
The 2 debug/log files that the above code writes to look like:
2022-02-18 10:37:56 PSURole -Name Admin IsMember: True
2022-02-18 10:37:56 PSURole -Name Supervisor IsMember: False
2022-02-18 10:37:56 PSURole -NameUser IsMember: True
(^^^ correct, all ok)
2022-02-18 10:43:50 PSURole -Name Admin IsMember: True
2022-02-18 10:43:50 PSURole -Name Admin IsMember: False
2022-02-18 10:43:51 PSURole -Name Supervisor IsMember: False
2022-02-18 10:43:51 PSURole -Name Supervisor IsMember: False
2022-02-18 10:43:51 PSURole -Name User IsMember: True
2022-02-18 10:43:51 PSURole -Name User IsMember: True
(^^^ ran through twice? and now Admin is set to false, bad)
2022-02-18 10:45:51 PSURole -Name Admin IsMember: False
2022-02-18 10:45:51 PSURole -Name Admin IsMember: True
2022-02-18 10:45:52 PSURole -Name Supervisor IsMember: False
2022-02-18 10:45:52 PSURole -Name Supervisor IsMember: False
2022-02-18 10:45:52 PSURole -Name User IsMember: True
2022-02-18 10:45:52 PSURole -Name User IsMember: True
(^^^ ran through twice again, but the 2nd time for PSURole admin shows True, so ok)
ATTEMPTED ACCESS FROM: DDDD\First.Last
To be in the ‘Admin’ role you need to be a member of SID: S-1-5-21-123123123123-123123123-12345
DDDD\First.Last is assigned to ‘Admin’ role: True
To be in the Supervisor role you need to be a member of SID: S-1-5-21-123123123123-123123123-66666
DDDD\First.Last is assigned to Supervisor role: False
To be in the User role you need to be a member of SID: S-1-5-21-123123123123-123123123-333333
DDDD\First.Last is assigned to User role: True
See how sometimes it writes out to the log just a single line for each New-PSURole:
New-PSURole -Name “Admin” -Description “admin policy”
New-PSURole -Name “Supervisor” -Description “supervisor policy”
New-PSURole -Name “User” -Description “user policy”
But at other times it appears to run each of those 3 New-PSURoles twice?
And what is tripping me up is sometimes the “admin poilicy” check will the first time return $true, then the second time return $false ?!?! How?! it’s the same lookup to check if a SamAccountName is part of an AD group (or nested group).
The only way to regain admin access is to recycle the Application Pool, and sometimes this takes multiple recycles before I get a valid $true for the admin PSURole.
I would love to know if someone has an explanation for this - or maybe even a better or more suitable/reliable way to create these 3 access policies based on AD group membership.
Cheers!
Steve.
