Introduction
There are many businesses out there that rely on multiple domains to operate their IT infrastructure. In these cases, it can make it difficult to process integration hub activities for the Microsoft AD Spoke to add or remove users in a group that belongs to a different domain. In this article I will describe the process I took to solve this problem I was facing when creating an automated solution for group memberships in AD via ServiceNow's Integration Hub using the Microsoft AD Spoke actions.
*I will be adding more to this article, so if there is somethings missing, I will try to add them as soon as I can.
Pre-Requisites
You would need minimum two plugins in order to use PowerShell and Microsoft AD Spoke actions in flow designer.
1. IntegrationHub - This enables you to use the PowerShell step in flow designer Action.
2. ServiceNow IntegrationHub Professional Pack Installer - This lets you use dynamic inputs in flow designer.
Refer to this link for more details about integration plugins for flow designer.
Connection & Credential Setup
Navigate to Connections & Credentials > Credentials and create a new windows credential that works with the AD Domain Controller(DC) that would be used as the primary DC.
Note: The best option would be to used the parent/root DC for the best outcome. However, during the process I was faced with, a child domain controller was used as the primary DC.
After confirming that the credential is successfully tested against the DC, navigate to Connection & Credentials > Connection & Credential Alias. Select the AD record that has the sn_ad_spoke.AD ID.
Note: AD will only exist when the Microsoft AD Spoke plugin is activated
Create a new connection shown in the related list of the AD Connection & Credential Alias.
Note: You can also just navigate to Connection & Credentials > Connections to create a new credential record, however you will have to select the type of Basic Connection for PowerShell & SSH and other details that would be automatically populated if done directly from the AD Connection & Credential Alias related list.
Configure MID Server Script Files
Navigate to MID Server > Script Files
Open the ActiveDirectoryMain.psm1 record and add the Add AD user account to Group Custom code block under the original code block name Add AD user account to Group seen in the code snippet below.
I replace $domainController for the userObject with $userdomaincustom. This allows for the creation of a custom input to place the users domain controller for the PowerShell to execute against.
######################
# Add AD user account to Group
#
######################>
function addADUserAccountToGroup {
param([string]$domainController, [string]$username, [string]$groupname, [boolean]$useCred, [System.Management.Automation.PSCredential]$credential)
SNCLog-ParameterInfo @("Running addADUserAccountToGroup", $domainController, $username, $groupname)
$userObject = getADObject -domainController $domainController -type "User" -objectName $username -useCred $useCred -credential $credential
$groupObject = getADObject -domainController $domainController -type "Group" -objectName $groupname -useCred $useCred -credential $credential
$groupObject.add("LDAP://"+$userObject.distinguishedName);
if (-not $?) {
SNCLog-DebugInfo "`tFailed to add $username account to $groupname group, $error"
}
}
######################
# Add AD user account to Group Custom
# This is the custom function added inside the ActiveDirectory script module
######################>
function addADUserAccountToGroupCrossDomain {
param([string]$userdomaincustom , [string]$domainController , [string]$username, [string]$groupname, [boolean]$useCred, [System.Management.Automation.PSCredential]$credential)
SNCLog-ParameterInfo @("Running addADUserAccountToGroup", $userdomaincustom, $domainController, $username, $groupname)
$userObject = getADObject -domainController $userdomaincustom -type "User" -objectName $username -useCred $useCred -credential $credential
$groupObject = getADObject -domainController $domainController -type "Group" -objectName $groupname -useCred $useCred -credential $credential
$groupObject.add("LDAP://"+$userObject.distinguishedName);
if (-not $?) {
SNCLog-DebugInfo "`tCould not get required info, $error"
}
}Perform the same action for the Remove AD user account from Group code block by adding Remove AD user account from Group Custom
###################################
# Remove AD user account from Group
###################################>
function removeADUserAccountFromGroup {
param([string]$domainController, [string]$username, [string]$groupname, [boolean]$useCred, [System.Management.Automation.PSCredential]$credential)
SNCLog-ParameterInfo @("Running removeADUserAccountFromGroup", $domainController, $username, $groupname)
$userObject = getADObject -domainController $domainController -type "User" -objectName $username -useCred $useCred -credential $credential
$groupObject = getADObject -domainController $domainController -type "Group" -objectName $groupname -useCred $useCred -credential $credential
$groupObject.remove("LDAP://"+$userObject.distinguishedName);
if (-not $?) {
SNCLog-DebugInfo "`tFailed to remove $username account from $groupname group, $error"
}
}
######################
# Remove AD user account from Group Custom
# This is the custom function added inside the ActiveDirectory script module
######################>
function removeADUserAccountFromGroupCrossDomain {
param([string]$userdomaincustom , [string]$domainController , [string]$username, [string]$groupname, [boolean]$useCred, [System.Management.Automation.PSCredential]$credential)
SNCLog-ParameterInfo @("Running removeADUserAccountFromGroup", $userdomaincustom, $domainController, $username, $groupname)
$userObject = getADObject -domainController $userdomaincustom -type "User" -objectName $username -useCred $useCred -credential $credential
$groupObject = getADObject -domainController $domainController -type "Group" -objectName $groupname -useCred $useCred -credential $credential
$groupObject.remove("LDAP://"+$userObject.distinguishedName);
if (-not $?) {
SNCLog-DebugInfo "`tCould not get required info, $error"
}
}
Create a copy of ActionAddUserToADGroup.ps1 and named it ActionRemoveUserFromGroupCrossDomain.ps1
import-module "$executingScriptDirectory\ADSpoke\ActiveDirectoryMain"
if (test-path env:\SNC_groupname) {
$groupname = $env:SNC_groupname;
$username = $env:SNC_username;
};
$groupname = $groupname -replace "%27","'";
$username = $username -replace "%27","'";
SNCLog-ParameterInfo @("Running AddUserToADGroup", $groupname, $username)
addADUserAccountToGroupCrossDomain -userdomaincustom $userdomaincustom -domainController $computer -username $username -groupname $groupname -useCred $useCred -credential $cred
Create a copy of ActionRemoveUserFromGroup.ps1 and named it ActionRemoveUserFromGroupCrossDomain.ps1
import-module "$executingScriptDirectory\ADSpoke\ActiveDirectoryMain"
if (test-path env:\SNC_groupname) {
$groupname = $env:SNC_groupname;
$username = $env:SNC_username;
};
$groupname = $groupname -replace "%27","'";
$username = $username -replace "%27","'";
removeADUserAccountFromGroupCrossDomain -userdomaincustom $userdomaincustom -domainController $computer -username $username -groupname $groupname -useCred $useCred -credential $cred
Create a copy of ActionIsUserFromGroup.ps1 and named it ActionIsUserFromGroupCrossDomain.ps1
import-module "$executingScriptDirectory\ADSpoke\ActiveDirectoryMain"
if (test-path env:\SNC_groupname) {
$groupname = $env:SNC_groupname;
$username = $env:SNC_username;
};
$groupname = $groupname -replace "%27", "'";
$username = $username -replace "%27", "'";
$userObject = getADObject -domainController $userdomaincustom -type "User" -objectName $username -useCred $useCred -credential $cred
$groupObject = getADObject -domainController $computer -type "Group" -objectName $groupname -useCred $useCred -credential $cred
#check user exists
if ($userObject -eq $null) {
Write-Host "Invalid UserName"
} else {
$userGroups = $userObject.memberOf
$groupname = $groupname.Replace("(","\(")
$groupname = $groupname.Replace(")","\)")
if ($userGroups -Match "CN=$groupname,") {
write-host "User is Member of group"
}
else {
write-host "User is not in group"
}
}Create a copy of ActionLookupGroup.ps1 and named it ActionLookupGroupCrossDomain.ps1
import-module activedirectory -warningaction "SilentlyContinue";
$groupName = $groupName -replace "%27","'";
$propertiesList = $propertiesList -replace "%27","'";
if ($propertiesList) {
$arr = $propertiesList -split ","
$arrpropertiesList = @($arr)
}
try{
$group = Get-ADGroup -Identity $groupName -Credential $cred -Server $groupdomaincustom -Properties $arrpropertiesList -ErrorAction Stop;
}catch{
$ErrorMessage = $_.Exception.Message;
}
if($ErrorMessage){
$result = "Error:"+$ErrorMessage;
}
else{
foreach($property in $group.PsObject.Properties){
$propName = $($property.Name);
if($propName -ne "PropertyNames" -and $propName -ne "nTSecurityDescriptor"){
$value = $($property.Value) | ConvertTo-Json -Compress;
if ($value -is [String]){
$value = $value.Trim();
}
if($value) {
$result = $result+ """$propName""" + ":" + $value + "," ;
}
else {
$result = $result+ """$propName""" + ":" + """""" + "," ;
}
}
}
}
Write-Host $result;Create a copy of ActionLookupUser.ps1 and named it ActionLookupUserCrossDomain.ps1
import-module activedirectory -warningaction "SilentlyContinue";
$userName = $userName -replace "%27","'";
$propertiesList = $propertiesList -replace "%27","'";
if ($propertiesList) {
$arr = $propertiesList -split ","
$arrpropertiesList = @($arr)
}
try{
$user = Get-ADUser -Identity $userName -Credential $cred -Server $userdomaincustom -Properties $arrpropertiesList -ErrorAction Stop;;
}catch{
$ErrorMessage = $_.Exception.Message;
}
if($ErrorMessage){
$result = "Error:"+$ErrorMessage;
}else {
foreach($property in $user.PsObject.Properties){
$propName = $($property.Name);
if($propName -ne "PropertyNames" -and $propName -ne "nTSecurityDescriptor"){
$value = $($property.Value) | ConvertTo-Json -Compress;
if ($value -is [String]){
$value = $value.Trim();
}
if($value) {
$result = $result+ """$propName""" + ":" + $value + "," ;
}
else {
$result = $result+ """$propName""" + ":" + """""" + "," ;
}
}
}
}
Write-Host $result;Once you have created the MID Server Script Files and altered the main.ps1 for the add and remove code then you should RESTART THE MID SERVER(s) in order for the new script files to be added to the MID Server for execution.
Configure Microsoft AD Spoke Actions
Navigate to Flow Designer and go to the Actions section.
Create copies of the following Microsoft AD Spoke actions:
| Name | Internal name | Application |
| Add User To Group | add_user_to_group | Microsoft AD Spoke |
| Is User In Group | is_user_in_group | Microsoft AD Spoke |
| Lookup Group | lookup_group | Microsoft AD Spoke |
| Remove User From Group | remove_user_from_group | Microsoft AD Spoke |
After copy of the action, navigate to the action and to the Inputs step of the Action Outline. Adding an input that will be used to consume the domain variable as mentioned in the MID Server Script Files.
In the next step named Create Payload (Script), add a new Input Variables that will have a data pill from the input from the first section as seen below.
Then, add the same variable in the Output variables section of the same step as seen below.
In the next step named Execute Action (PowerShell), update the MID Server Script field with the newly created (copied) MID Server Script File created earlier for execution of the modified code. Make sure it lines up with the action that you copied.
For example:
| If the action is: | Then update the MID Server Script field to: |
| Add User To Group | ActionAddUserToADGroupCrossDomain.ps1 |
| Is User In Group | ActionIsUserFromGroupCrossDomain.ps1 |
| Lookup Group | ActionLookupGroupCrossDomain.ps1 |
| Remove User From Group | ActionRemoveUserFromGroupCrossDomain.ps1 |
In the input variables section, continue to create the input like the other steps and then add the data pill that is for the create payload step that is associated to the output you created name step > Create Payload > userdomaincustom.
Once completed, save the action and test. Once tested successfully, publish the action in order to be used within the flow.
Configuring Flow/SubFlow Action Steps
After the newly created actions are ready to be used, enter in the userID for the user name and for the userdomaincustom enter the domain controller servers host name.
I would like to give a shout out and credit to Deepak's blog which helped guide me to this solution:
I also took some direction from this support document:
