Page 1 of 1 1
Topic Options
#209943 - 2015-02-12 08:42 AM Alternative to InGroup and EnumGroups?
mrimri
Unregistered


Hi,

as InGroup and EnumGroups (not sure if there is a problem too) are not reliable, is there an alternative to them?
I'm currently looking in any direction and tried to migrate our login script to powershell. I also thought about AutoIt but all of it will take much hours of work.

So, as I found many people having problems with InGroup, I thought someone perhaps has written its own replacement using LDAP or something.

Top
#209944 - 2015-02-12 01:21 PM Re: Alternative to InGroup and EnumGroups? [Re: ]
Glenn Barnas Administrator Offline
KiX Supporter
*****

Registered: 2003-01-28
Posts: 4403
Loc: New Jersey
Had been meaning to publish this for a while now..
 Code:
; ======================================================================
; Check Group Membership - the arg can be a comma-delimited list of groups
; Membership in any listed group will return TRUE
Function fInGroup($_Group)

  Dim $_I						; Index Var
  Dim $_C						; Count of matched groups
  Dim $_oSys, $_oTarget					; Connection Objects
  Dim $_aMemberOf, $_MemberOf				; Array of groups, enumerator
  Dim $_aGroups						; array of groups that the user is a member of


  $fInGroup = 0						; default FALSE
  $_C = -1						; no memberships

  $_I = -1
  Do
    $_I = $_I + 1
    ReDim Preserve $_aGroups[$_I]
    $_aGroups[$_I] = ENUMGROUP($_I)
    If InStr($_aGroups[$_I], '\')
      $_aGroups[$_I] = Split($_aGroups[$_I], '\')[1]
    EndIf
  Until EnumGroup($_I) = ''

  $_I = $_I - 1

  $_oSys = CreateObject('ADSystemInfo')			; instantiate connection
  $_oTarget = GetObject('LDAP://' + $_oSys.UserName)	; Connect to AD
  $_aMemberOf = $_oTarget.GetEx('memberOf')		; Get list of groups
  For Each $_MemberOf in $_aMemberOf
    $_MemberOf = Split(Split($_MemberOf, '=')[1], ',')[0]
    If AScan($_aGroups, $_MemberOf) = -1
      $_I = $_I + 1
      ReDim Preserve $_aGroups[$_I]
      $_aGroups[$_I] = $_MemberOf
    EndIf
  Next

  $_aInGroups = Split($_Group, ',')
  For Each $_Group in $_aInGroups
    If AScan($_aGroups, $_Group) > -1
      $_C = $_C + 1
    EndIf
  Next

  If $_C > -1 $fInGroup = 1 EndIf
  Exit Not $fInGroup

EndFunction
I'll put a real header on it and post it in the UDF forum and on my site later today.

Glenn
_________________________
Actually I am a Rocket Scientist! \:D

Top
#209945 - 2015-02-12 01:48 PM Re: Alternative to InGroup and EnumGroups? [Re: Glenn Barnas]
Lonkero Administrator Offline
KiX Master Guru
*****

Registered: 2001-06-05
Posts: 22346
Loc: OK
There should be...
_________________________
!

download KiXnet

Top
#209946 - 2015-02-12 01:49 PM Re: Alternative to InGroup and EnumGroups? [Re: Lonkero]
Lonkero Administrator Offline
KiX Master Guru
*****

Registered: 2001-06-05
Posts: 22346
Loc: OK
Like this
http://www.kixtart.org/forums/ubbthreads.php?ubb=showflat&Number=144167
_________________________
!

download KiXnet

Top
#209947 - 2015-02-12 01:54 PM Re: Alternative to InGroup and EnumGroups? [Re: Lonkero]
Lonkero Administrator Offline
KiX Master Guru
*****

Registered: 2001-06-05
Posts: 22346
Loc: OK
Mrimri, what is the issue you are having? You are not trusting ingroup() or is there a specific group that doesn't get processed? If latter, please let us know more about the group (nested, distribution/security. Local domain/universal, does it have email description or other fields filled and so on)
_________________________
!

download KiXnet

Top
#209948 - 2015-02-12 03:05 PM Re: Alternative to InGroup and EnumGroups? [Re: Lonkero]
Glenn Barnas Administrator Offline
KiX Supporter
*****

Registered: 2003-01-28
Posts: 4403
Loc: New Jersey
Jooel - about two years ago there was a discussion about Universal groups not being recognized in InGroup(). I even created a Universal Group just to verify this. The result was using the EnumGroup() plus the LDAP query to combine the list of groups for complete detection, as I posted above. There were also issues with Security groups having email addresses...

I'm not sure what changed since then, but when I now go back to run the test script, both InGroup() and fInGroup() return true for membership in all groups, including Universal groups and mail-enabled security groups. I ran the test with all reasonable versions of Kix, from 4.53 to 4.64 with identical results. (I'm on AD 2012r2 native here.) I recall also that this was an issue at the AD consolidation project I was on about 18 months ago - they were AD 2008r2 at the time.

Could the issue have been resolved by a MS patch since then? I haven't made any significant changes to my environment since then.

I can't find the original discussion or I'd reference it.

Glenn
_________________________
Actually I am a Rocket Scientist! \:D

Top
#209950 - 2015-02-12 03:51 PM Re: Alternative to InGroup and EnumGroups? [Re: Glenn Barnas]
Lonkero Administrator Offline
KiX Master Guru
*****

Registered: 2001-06-05
Posts: 22346
Loc: OK
I had similar issue half an year ago. I got special version of kix from Ruud that worked fine. later on, tried with normal kix and the issue has been resolved, so indeed it might have been MS messing up again.

this is also why I would like to know what is the cause of this thread.
_________________________
!

download KiXnet

Top
Page 1 of 1 1


Moderator:  Jochen, Allen, Radimus, Glenn Barnas, ShaneEP, Ruud van Velsen, Arend_, Mart 
Hop to:
Shout Box

Who's Online
1 registered (Henriques) and 2516 anonymous users online.
Newest Members
fgarcia, Viginette, ManuvdWielNL, Sir_Barrington, batdk82
17889 Registered Users

Generated in 0.06 seconds in which 0.03 seconds were spent on a total of 13 queries. Zlib compression enabled.

Search the board with:
superb Board Search
or try with google:
Google
Web kixtart.org