I'm a colleague of adowns. Here is a similar script we found. I've also wrote up our specific use cases.
https://www.adaxes.com/script-repositor ... ps-s36.htm
Is Adaxes capable of notifying group owners of indirect membership changes? Can the above script be modified to request approval for membership change operations via a indirect membership?
User1 (AD field 'Manager=Manager1') is a member of JobRoleGroup1 (Managed by Manager1) which is a member of NonADIntegratedResourceGroup1 (Managed by Manager2).
When User1 is added to a JobRoleGroup or is removed from a JobRoleGroup, we'd like to notify Manager2, via their the ownership of NonADIntegratedResourceGroup1, that they need to update their System/Access Control List that not integrated with AD.
Basically we are creating place holder groups for non AD integrated systems so we can use Adaxes reporting and automation functionality. This allows us to run an audit report on a user and see what they should have access to. It also builds the framework needed for non AD integrated systems if they later on gain AD integration functionality.
For these types of groups we are prefixing them with Eres_groupname, meaning External Resource (external to AD intergration).
As an additional piece of information, we've structured our JobRole groups as Role_%title% where the %title% matches the User's AD title property. When Human Resources enters a user title such as 'Test' via the Adaxes Web, we've programmed it to look for matching a matching Role Group which in this case would be Role_Test. If a role group is not found that matches that %title% then Adaxes sends an exception to us (IT dept.) before proceeding. We then have a conversation with HR and the User's manager on what access permissions this employee needs and we build a new Job_%title% group. We then restart this held business rule process and it proceeds to complete the other subsequent process.
With this in mind, we have another scenario to consider.
User1 (AD field 'Manager'=Manager1) is a member of Role_Job1 (Managed by Manager1) which is a member of Eres_NonADIntegratedResourceGroup1 (Managed by Manager2). User1 is promoted, removed from Role_Job1 and becomes a member of Role_Job2 (AD field 'Manager'=Manager3) which is also member of Eres_NonADIntegratedResourceGroup (Managed by Manager2).
In that scenario, two permission changes will happen to the indirect group and would notify the group owner. However since they still are a member of the indirect group before and after the JobRole group change, we are wondering if there is a way to cancel out the approval request going to Manager2.
We envision that this is how the process would run..
Human Resources via the Adaxes web interface changes the employees Job title and submits the changes. We're open to having HR fill out two fields in the Adaxes web form if needed, such as current Job Title and new Job Title. We also may have HR complete a field such as an effective date to indicated when the employee starts working in their new role as it may be a few days out.
Before execution, we run a Business Rule and via Powershell create arrays with the following information. We query the User1's current Role_Jobtitle1 and all of its indirect memberships. We then query the User1's new Role_Jobtitle2 and all of its indirect memberships. We then compare the indirect group memberships of ERES_%groupname% in the two arrays. Then for each unique ERES_%groupname%, we query the Manage By AD field and email the group owner for approval. Any matching ERES_%groupname% entries are ignored as that would create a duplicated request. Once approvals are completed and if the effective date is the same day, Adaxes proceeds with the changed.
Thank you for reviewing our request.