Functions for creation of Policy links

Back to PowerShell samples

This set of functions allow the creation of new policy links and blocking of existing policy links via powershell.

EG to create a new policy link to the policy "My User Check" on the Account OU

CreatePOLink -PolicyObjectIdentity "My User Check" -ObjectToApplyDN "OU=Accounts, dc=mydomain, dc=com"

To block a link or inherited link BlockPOLink -PolicyObjectIdentity "My User Check" -ObjectToApplyDN "OU=Accounts, dc=mydomain, dc=com"

function GetNewGuid {

return [System.Guid]::NewGuid().tostring()

}

1. Creates a Policy Object Link
2. Parameters
3. PolicyObjectIdentity : Name, DN or cn of policy object
4. ObjectToApplyDN : DN of container
5. Blocked : True or false .Is it to be created as a blocked policy

Function CreatePOLInk {

param ( [string]$PolicyObjectIdentity,

[string]$ObjectToApplyDN,

[boolean]$Blocked=$false )

# Set the parent container

$APLinksContainerDN="CN=AP Links,CN=Configuration"

# Get a new guid

$APLinkName=GetNewGuid

if ($Blocked){

$APLinkName=$APLInkName + '[Blocked]'

}

# Get the Policy Object Guid

$PolicyObject=get-qadObject $PolicyObjectIdentity -DontUseDefaultIncludedProperties

$APOGuid=$policyObject.Guid.toByteArray()

# Get the Managed Object Guid

$ManagedObject=get-qadObject $ObjectToApplyDN -DontUseDefaultIncludedProperties

$SecObjectGuid=$ManagedObject.Guid.toByteArray()

# Now create the link

$newObj=new-qadobject -parentcontainer $APLInksContainerDN -type 'edsPolicyObjectLink' -name $APlinkName -ObjectAttributes @{"edsaAPOGUID"=$APOGuid;"edsaSecObjectGuid"=$SecObjectGuid;"edsaBlockingLink"=$Blocked}

$NewObj

}

Function BlockPOLink {

param ( [string]$PolicyObjectDN,

[string]$ObjectToApplyDN

)

# Set the parent container

$APLinksContainerDN="CN=AP Links,CN=Configuration"

# Get the Policy Object Guid

$PolicyObject=get-qadObject $PolicyObjectDN -DontUseDefaultIncludedProperties

$APOGuid=$policyObject.Guid.tostring()

write-host ("Policy Object Guid : $APOGuid")

# Get the Managed Object Guid

$ManagedObject=get-qadObject $ObjectToApplyDN -DontUseDefaultIncludedProperties

$SecObjectGuid=$ManagedObject.Guid.tostring()

write-host ("Security Object Guid : $SecObjectGuid")

$ldapFilter="(&(edsaSecObjectGUID=$SecObjectGuid)(edsaAPOGUID=$APOGuid))"

write-host ("Searching for POLink $ldapFilter")

# Get the link for the object

$POLInk=get-qadobject -searchroot $APLinksContainerDN -ldapfilter $ldapFilter

write-host ("Found Link : $POLink")

# Does the link exist ?

# If not then create the blocked link

if ($POLink -eq $null){

write-host ("Creating blocked link : $PolicyObjectDN for container $ObjectToApplyDN")

$POLink=CreatePOLink -PolicyObjectDN $PolicyObjectDN -ObjectToApplyDN $ObjectToApplyDN -Blocked $true

write-host ("Created Link : $POLink")

$Set=set-qadobject -identity $POLink -ObjectAttributes @{"edsaBlockinglink"=$true}

}

else{

$set=set-qadobject -identity $POLink -ObjectAttributes @{"edsaBlockinglink"=$true}

}

}

Back to PowerShell samples