Hello Horst,
Yes, it is possible. The solution will include a group, a Scheduled Task and a Home Page action. The group will include only users that manage groups. The task will add/remove members from the managers group. The Home Page Action will allow managers to add new members only to groups they manage.
Also, you will need to allow access to the Self-Service Web interface only for members of the managers group.
For information on how to create the group, have a look at the following help article: https://www.adaxes.com/help/?HowDoI.Man ... Group.html.
For information on how to allow access to the Self-Service Web interface only for members of the new group, have a look at the following help article: https://www.adaxes.com/help/?HowDoI.Con ... ccess.html.
i. Creating the Scheduled Task
-
Launch Adaxes Administration Console.
-
Right-click your Adaxes service node, navigate to New and click Scheduled Task.
-
On step 3 of the Create Scheduled Task wizard, select User Object type and click Next.
-
Click Add Action.
-
Select Run a program or PowerShell script.
-
Paste the script below into the Script field.
$groupManagersDN = "CN=Managers,OU=Groups,DC=domain,DC=com" # TODO: modify me
function SearchObjects($filter)
{
$domain = $Context.GetObjectDomain("%distinguishedName%")
$searcher = $Context.BindToObject("Adaxes://$domain")
$searcher.SearchFilter = $filter
$searcher.SearchScope = "ADS_SCOPE_SUBTREE"
$searcher.PageSize = 500
try
{
$searchResultIterator = $searcher.ExecuteSearch()
$searchResults = $searchResultIterator.FetchAll()
return ,$searchResults
}
finally
{
# Release resources
if ($searchResultIterator){ $searchResultIterator.Dispose() }
}
}
function UpdateGroupMembership($groupDN, $operation)
{
$group = $Context.BindToObjectByDN($groupManagersDN)
switch ($operation)
{
"Add"
{
if (!($group.IsMember($Context.TargetObject.AdsPath)))
{
$group.Add($Context.TargetObject.AdsPath)
}
}
"Remove"
{
if ($group.IsMember($Context.TargetObject.AdsPath))
{
$group.Remove($Context.TargetObject.AdsPath)
}
}
}
}
# Get managed objects
try
{
$managedObjects = $Context.TargetObject.GetEx("managedObjects")
}
catch
{
UpdateGroupMembership $groupManagersDN "Remove"
return
}
# Check managed objects
$filter = New-Object "System.Text.StringBuilder"
[void]$filter.Append("(&(objectCategory=group)(|")
foreach ($dn in $managedObjects)
{
[void]$filter.Append([Softerra.Adaxes.Ldap.FilterBuilder]::Create("distinguishedName", $dn))
}
[void]$filter.Append("))")
$searchResults = SearchObjects $filter.ToString()
if ($searchResults.Length -eq 0)
{
UpdateGroupMembership $groupManagersDN "Remove"
}
else
{
UpdateGroupMembership $groupManagersDN "Add"
}
-
Enter a short description and click OK.
-
Click Next and finish creating the Scheduled Task.
ii. Creating the Home Page Action
- Launch Adaxes Web Interface Customization Tool.
- Select the interface type and click Configure Home Page Actions on the General tab.
- Click Add and select the Add to Group action.
- On step 2 of the wizard, define the conditions for selecting users to be added to the groups and click Next.
- Select Allow selecting only AD objects that match the specific LDAP filter.
- Enter the following into the LDAP filter field:
(&(objectCategory=group)(managedBy=%distinguishedName%))
- Click Finish.