Steven,
Nice work with the scripts and new activity. That could be very useful to a lot of people.
I had a similiar need and accomplished it with a sub workflow off of our primary main Access Request workflow.
Essentially I pass the User ID and AD groups the user needs to be added to (and the apps just for notifying the AD Team and commenting on the RITM) in workflow inputs and then loop through each group to add the user. It will create a manual task for the AD Team if the Orchestration error is anything besides "The object already exists". It will then comment on the RITM what was done and send an email to the AD Team to let them know what was completed:
Email to Active Directory Team:
RITM Comments:
Hey Parimala,
Here is the run script where I add the error to a scratchpad variable (Above the IF statement in the below screenshot):
var addtogroupoutput = data.get(3).errorMessage;
workflow.scratchpad.addtogrouperror = addtogroupoutput;Here is the IF script I use to handle the error:
answer = ifScript();
function ifScript() {
if (workflow.scratchpad.addtogrouperror.indexOf("The object already exists") > -1) {
return 'no';
}
return 'yes';
}Basically that IF script says "If object already exists shows up in the error, then no I do not need a manual task". indexOf is the "contains" like function of ServiceNow.
You just need to change "workflow.scratchpad.addtogrouperror" to your "errorMsg". I stored the error in a scratchpad variable (I did this in the Run Script above the IF) so I could use it in this IF statement:
Hey Saranya,
currently the way it is, is that if the script cannot find an AD object, it stops and returns an error.
we can add some "error" handling into the script and not make it return an error and stop, but continue through all users/groups.
<############################################
# CUSTOM - Add AD user account to Group
############################################>
function CUSTOMaddADUsersToGroups {
param([string]$domainController, [string]$username, [string]$groupname, [boolean]$useCred, [System.Management.Automation.PSCredential]$credential)
SNCLog-ParameterInfo @("Running CUSTOMaddADUsersToGroups ", $domainController, $username, $groupname)
$userObject = getADObject -domainController $domainController -type "User" -objectName $username -useCred $useCred -credential $credential
$groupObject = getADObject -domainController $domainController -type "Group" -objectName $groupname -useCred $useCred -credential $credential
if ($userObject -eq $null) {
SNCLog-DebugInfo "`tERROR: Could not find user: '$username', $error"
return $result = "`tERROR: Could not find user: '$username', $error"
}
if ($groupObject -eq $null) {
SNCLog-DebugInfo "`tERROR: Could not find group: '$groupname', $error"
return $result = "`tERROR: Could not find group: '$groupname', $error"
}
$groupIdentity = $groupObject.Properties["member"].Value
$userIdentity = $userObject.Properties["distinguishedName"].Value
If ($groupIdentity -notcontains $userIdentity ) {
$groupObject.add("LDAP://" + $userObject.distinguishedName);
if (-not $?) {
SNCLog-DebugInfo "`tERROR: Failed to add user: '$username' account to group: $groupname, $error"
return $result = "`tERROR: Failed to add user: '$username' account to group: $groupname, $error"
}
else {
SNCLog-DebugInfo "`tSUCCESS: user: '$username' Added to group: '$groupname'"
return $result = "`tSUCCESS: user: '$username' Added to group: '$groupname'"
}
}
else {
SNCLog-DebugInfo "`tSKIPPED: user: '$username' Already a member of group: '$groupname'"
return $result = "`tSKIPPED: user: '$username' Already a member of group: '$groupname'"
}
}
<#########################################################
# CUSTOM - Remove AD user account from Group
#########################################################>
function CUSTOMremoveADUsersAccountFromGroups {
param([string]$domainController, [string]$username, [string]$groupname, [boolean]$useCred, [System.Management.Automation.PSCredential]$credential)
SNCLog-ParameterInfo @("Running CUSTOMremoveADUsersAccountFromGroups ", $domainController, $username, $groupname)
$userObject = getADObject -domainController $domainController -type "User" -objectName $username -useCred $useCred -credential $credential
$groupObject = getADObject -domainController $domainController -type "Group" -objectName $groupname -useCred $useCred -credential $credential
if ($userObject -eq $null) {
SNCLog-DebugInfo "`tERROR: Could not find user: '$username', $error"
return $result = "`tERROR: Could not find user: '$username', $error"
}
if ($groupObject -eq $null) {
SNCLog-DebugInfo "`tERROR: Could not find group: '$groupname', $error"
return $result = "`tERROR: Could not find group: '$groupname', $error"
}
$groupIdentity = $groupObject.Properties["member"].Value
$userIdentity = $userObject.Properties["distinguishedName"].Value
If ($groupIdentity -contains $userIdentity ) {
$groupObject.remove("LDAP://" + $userObject.distinguishedName);
if (-not $?) {
SNCLog-DebugInfo "`tERROR: Failed to remove user: '$username' account to group: $groupname, $error"
return $result = "`tERROR: Failed to remove user: '$username' account to group: $groupname, $error"
}
else {
SNCLog-DebugInfo "`tSUCCESS: user: '$username' Removed From group: '$groupname'"
return $result = "`tSUCCESS: user: '$username' Removed From group: '$groupname'"
}
}
else {
SNCLog-DebugInfo "`tSKIPPED: user: '$username' Is NOT a member of group: '$groupname'"
return $result = "`tSKIPPED: user: '$username' Is NOT a member of group: '$groupname'"
}
}
and now to make this work as is, we have to edit one more thing. I'll post the whole function here, but it's in the getADObject, we have to comment out a line that returns the errors and causes it to stop.
it is this:
<######################
# Fetch an existing AD object by name
#
######################>
function getADObject {
param([string]$domainController, [string]$type, [string]$objectName, [boolean]$useCred, [System.Management.Automation.PSCredential]$credential)
SNCLog-ParameterInfo @("Running getADObject", $domainController, $type, $objectName)
$rootEntry = getDirectoryEntryObject -path "LDAP://$domainController" -useCred $useCred -credential $credential
$search = New-Object System.DirectoryServices.DirectorySearcher $rootEntry;
$sAMAccountName = getSAMAccountName -name $objectName -type $type
SNCLog-DebugInfo "`t`$sAMAccountName:$sAMAccountName"
$search.Filter = "(&(objectClass=$type)(samaccountname=$sAMAccountName))";
$result = $search.FindOne();
if ($result -eq $null) {
SNCLog-DebugInfo "`tUnable to find the AD object"
<### throw New-Object System.ArgumentException($search.Filter + " could not be found"); ###>
return $null;
}
$object = $result.GetDirectoryEntry();
if ($object -eq $null) {
SNCLog-DebugInfo "`tUnable to retrieve the object from AD"
throw New-Object System.ArgumentException("The object could not be retrieved from: " + $search.Filter);
}
return $object;
}
this is what it used to do:
