Programmatically add direct assignment ADSAccountInADSGroup even as deferred operation

Question

Hi all, Community 
 I am trying to programmatically set up some deferred operations in order to directly assign an ADSGroup to an AdsAccount. This should be done also for existing indirect assignments. 
 Usually, if I have to do it &ldquo;runtime&rdquo; (not deferred operation), I can execute from the script a sql query (mySQLExec.SqlExecuteNonQuery(&ldquo;update ADSAccountInADSGroup set XOrigin = x where &hellip;. &rdquo;) ) but this cannot be done in a deferred operation block as it is executed immediately. In deferred operation block I need to base the updates I want to persist throughout the deferred operation to IsingleObject or Entity, but as I tried to update the field XOrign I keep on getting permission exceptions, no matter what I do. 
 So, can someone give me some ideas how to solve this problem? Maybe there is a better way than to directly querying the DB. Some method or else linked to ISingleDbObject or Entity &hellip; 
 Thank you in advance to anyone who can provide detail. 
 
 Alberto

Markus Weiss-Ehlers · Answer

Add a direct membership in ADSAccountInADSGroup is always a simple Insert operation into ADSAcountInADSGroup using the object layer, regardless of the entity is already present with XOrigin = 2 as long as the lowest bit is not set (which represents the direct assignment). 
 The same is true for a delete operation. The object layer automatically converts the operation internally to an update of the Xorigin property. 
 So in your use case, you just need to create the correct iEntity operations in your deferred block. 
 HTH

Markus Weiss-Ehlers · Answer

Yes, this should work. Again, iEntity usage should be preferred. Here two samples including the deferred block. 
 Sample: Using a Deferred Block for IEntities 
 
 ' Create a new DeferredBlock for a point in time. 
 Using New VI . DB . DeferredOperations . DeferredBlock (Session, DateTime . UtcNow . AddDays( 45 ), "Optional description for operation" )
 ' Operations done here are done deferred 
 Dim dbObj = Session . Source() . CreateNew( "PersonInOrg" )
 dbObj . PutValue( "UID_Person" , "a76311be-c2cd-4be3-be5d-b8d85c3bb863" )
 dbObj . PutValue( "UID_Org" , "b0b4be5a-bcc1-453d-aaf5-b5a7d8531224" )
 
 Using uow = Session . StartUnitOfWork()
 uow . Put(dbObj)
 uow . Commit()
 End Using 
 End Using

Sample: Using a deferred block for ISingleDBObjects 
 
 ' Create a new DeferredBlock for a point in time. 
 Using New VI . DB . DeferredOperations . DeferredBlock (Connection, DateTime . UtcNow . AddDays( 45 ), "Optional description for operation" )
 ' Operations done here are done deferred 
 Dim dbObj = Connection . CreateSingle( "PersonInOrg" )
 dbObj . PutValue( "UID_Person" , "a76311be-c2cd-4be3-be5d-b8d85c3bb863" )
 dbObj . PutValue( "UID_Org" , "b0b4be5a-bcc1-453d-aaf5-b5a7d8531224" )
 dbObj . Save()
 End Using

Markus Weiss-Ehlers · Answer

So here is the correct solution. To create a direct assignment for an existing membership, you can call the AssignDirect method. 
 I've updated my sample code (using your variables) to reflect this change. 
 Public Sub CCC_AssignDirect(UID_ADSAccount As String, uid_group As String)
 ' Create a new DeferredBlock for a point in time.
 Using New VI.DB.DeferredOperations.DeferredBlock(Session, DateTime.UtcNow.AddDays(45), "Optional description for operation")
 ' Operations done here are done deferred

Using uow = Session.StartUnitOfWork()
 Dim dbEntity As IEntity = Nothing
 Dim dbKey As DbObjectKey = New DbObjectKey(Table.ADSAccountInADSGroup, New String() {UID_ADSAccount, uid_group})
 ' Check if memberships already exists

If Session.Source().TryGet(dbKey, EntityLoadType.Default, dbEntity) Then
 'if exists call AssignDirect method
 dbEntity.CallMethod("AssignDirect")
 Else
 'if not exists create new membershio
 dbEntity = Session.Source().CreateNew(Table.ADSAccountInADSGroup)
 dbEntity.PutValue(Table.ADSAccountInADSGroup.UID_ADSAccount, UID_ADSAccount)
 dbEntity.PutValue(Table.ADSAccountInADSGroup.UID_ADSGroup, uid_group)
 End If
 uow.Put(dbEntity)
 uow.Commit()
 End Using
 End Using
End Sub

Endpoint Privilege Management

Programmatically add direct assignment ADSAccountInADSGroup even as deferred operation