Closed Wim-Dams closed 3 years ago
Thanks for the report @Wim-Dams , will find some time to take a look.
Hi Pete,
Thank you very much for looking into this.
Issue only happens when you pipe your object to the Add-PASSafeMember command. When you really specify the individual parameters it indeed works.
Connect-ScriptAccount
$SafePermissions = [PSCustomObject]@{
UseAccounts = $True
ListAccounts = $True
RetrieveAccounts = $True
InitiateCPMAccountManagementOperations = $True
SpecifyNextAccountContent = $True
}
$SafePermissions | Add-PASSafeMember -SafeName "PERS_U30300" -MemberName "U30300" -SearchIn "ActiveDirectory" | Select-Object -ExpandProperty Permissions
Get-PASSafeMember -SafeName "PERS_U30300" | where UserName -eq U30300
useAccounts : True
retrieveAccounts : True
listAccounts : True
addAccounts : False
updateAccountContent : False
updateAccountProperties : False
initiateCPMAccountManagementOperations : False
specifyNextAccountContent : False
renameAccounts : False
deleteAccounts : False
unlockAccounts : False
manageSafe : False
manageSafeMembers : False
backupSafe : False
viewAuditLog : False
viewSafeMembers : False
accessWithoutConfirmation : False
createFolders : False
deleteFolders : False
moveAccountsAndFolders : False
requestsAuthorizationLevel1 : False
requestsAuthorizationLevel2 : False
safeUrlId : PERS_U30300
safeName : PERS_U30300
safeNumber : 54
memberId : 106
memberName : U30300
memberType : User
membershipExpirationDate :
isExpiredMembershipEnable : False
isPredefinedUser : False
permissions : @{useAccounts=True; retrieveAccounts=True; listAccounts=True; addAccounts=False; updateAccountContent=False; updateAccountProperties=False; initiateCPMAccountManagementOperations=False; specifyNextAccountContent=False;
renameAccounts=False; deleteAccounts=False; unlockAccounts=False; manageSafe=False; manageSafeMembers=False; backupSafe=False; viewAuditLog=False; viewSafeMembers=False; accessWithoutConfirmation=False; createFolders=False;
deleteFolders=False; moveAccountsAndFolders=False; requestsAuthorizationLevel1=False; requestsAuthorizationLevel2=False}
UserName : U30300
Van: Pete Maan @.> Verzonden: zaterdag 22 mei 2021 2:07 Aan: pspete/psPAS @.> CC: Wim-Dams @.>; Mention @.> Onderwerp: Re: [pspete/psPAS] Issue with CPM permissions in Add-PASSafeMember.ps1 script (#349)
Hi @Wim-Dams https://github.com/Wim-Dams - the issue is not reproducible here.
Add-PASSafeMember -SafeName issue_349 -MemberName pspete -InitiateCPMAccountManagementOperations $true
-SpecifyNextAccountContent $true |
Select-Object -ExpandProperty Permissions
useAccounts : False retrieveAccounts : False listAccounts : False addAccounts : False updateAccountContent : False updateAccountProperties : False initiateCPMAccountManagementOperations : True specifyNextAccountContent : True renameAccounts : False deleteAccounts : False unlockAccounts : False manageSafe : False manageSafeMembers : False backupSafe : False viewAuditLog : False viewSafeMembers : False accessWithoutConfirmation : False createFolders : False deleteFolders : False moveAccountsAndFolders : False requestsAuthorizationLevel1 : False requestsAuthorizationLevel2 : False
Can you provide more information? Do the permissions get added if the -UseGen1API switch is specified? What is the content of $PermissionObject.Permissions?
— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/pspete/psPAS/issues/349#issuecomment-846315973 , or unsubscribe https://github.com/notifications/unsubscribe-auth/AUEUM2JZF4IB6GVCF4GTW2TTO3YS7ANCNFSM45GUIQMQ . https://github.com/notifications/beacon/AUEUM2O3MUFJX3BNKBC75EDTO3YS7A5CNFSM45GUIQM2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOGJY4DRI.gif
Hi @Wim-Dams - yes, initially I couldn't replicate, but then noticed the same regarding piping an object into the function. Fix incoming (already present in the issue-349 branch).
Thanks for reporting this, very much appreciated!
Describe the issue I really love this PsPas module but when we upgrade to version 5.0.0 suddenly all new created safes didn't have the CPM permissions anymore. When we just use the Add-PASSafeMember script like below it set's all permissions, except InitiateCPMAccountManagementOperations=True; SpecifyNextAccountContent=True;
CommandUsed = $result = $PermissionObject.Permissions | Add-PASSafeMember -SafeName $SafeName -MemberName $UserName -SearchIn $SearchInValue -ErrorAction Stop
Possible fix My current quickfix was to add the following to these 2 parameters. [parameter( Mandatory = $true, ValueFromPipelinebyPropertyName = $true, ParameterSetName = 'Gen2' )]
In the script itself it uses "{ $PSItem -match '^Gen2' }" so everything that starts with Gen2, like Gen2-CPM is excepted so I guess the issue is in command "ConvertTo-SortedPermission -Gen2" where you only to a case check on the complete value and discard all the rest.
I'm not sure my quickfix was a good one.
Your Environment Include relevant details about your environment