#497

pending completion

Build # #497

Build Type

push

github-actions

Committed by

web-flow

Commit Message

<a href="https://github.com/Badgerati/Pode/commit/<a class=hub.com/Badgerati/Pode/commit/c283754a14b922faa8ffb082e91c8a61abb31465">c283754a1<a href="https://github.com/Badgerati/Pode/commit/c283754a14b922faa8ffb082e91c8a61abb31465">">Merge </a><a class="double-link" href="https://github.com/Badgerati/Pode/commit/<a class="double-link" href="https://github.com/Badgerati/Pode/commit/70f9d7cb785eb93c300cdaa5ae861ccaf80faa93">70f9d7cb7</a>">70f9d7cb7</a><a href="https://github.com/Badgerati/Pode/commit/c283754a14b922faa8ffb082e91c8a61abb31465"> into 28e3f2a5f">28e3f2a5f</a>

Run Details

15 of 15 new or added lines in 1 file covered. (100.0%)

2290 of 4649 relevant lines covered (49.26%)

1.26 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

12.5

/src/Private/Authentication.ps1

function Get-PodeAuthBasicType
{
    return {
        param($e, $options)

        # get the auth header
        $header = (Get-PodeHeader -Name 'Authorization')
        if ($null -eq $header) {
            return @{
                Message = 'No Authorization header found'
                Code = 401
            }
        }

        # ensure the first atom is basic (or opt override)
        $atoms = $header -isplit '\s+'
        if ($atoms[0] -ine $options.HeaderTag) {
            return @{
                Message = "Header is not for $($options.HeaderTag) Authorization"
                Code = 400
            }
        }

        # decode the auth header
        try {
            $enc = [System.Text.Encoding]::GetEncoding($options.Encoding)
        }
        catch {
            return @{
                Message = 'Invalid encoding specified for Authorization'
                Code = 400
            }
        }

        try {
            $decoded = $enc.GetString([System.Convert]::FromBase64String($atoms[1]))
        }
        catch {
            return @{
                Message = 'Invalid Base64 string found in Authorization header'
                Code = 400
            }
        }

        # validate and return user/result
        $index = $decoded.IndexOf(':')
        $username = $decoded.Substring(0, $index)
        $password = $decoded.Substring($index + 1)

        # return data for calling validator
        return @($username, $password)
    }
}

function Get-PodeAuthFormType
{
    return {
        param($e, $options)

        # get user/pass keys to get from payload
        $userField = $options.Fields.Username
        $passField = $options.Fields.Password

        # get the user/pass
        $username = $e.Data.$userField
        $password = $e.Data.$passField

        # if either are empty, fail auth
        if ([string]::IsNullOrWhiteSpace($username) -or [string]::IsNullOrWhiteSpace($password)) {
            return @{
                Message = 'Username or Password not supplied'
                Code = 401
            }
        }

        # return data for calling validator
        return @($username, $password)
    }
}

function Get-PodeAuthInbuiltMethod
{
    param (
        [Parameter(Mandatory=$true)]
        [ValidateSet('WindowsAd')]
        [string]
        $Type
    )

    switch ($Type.ToLowerInvariant())
    {
        'windowsad' {
            $script = {
                param($username, $password, $options)

                # validate and retrieve the AD user
                $noGroups = $options.NoGroups
                $result = Get-PodeAuthADUser -Fqdn $options.Fqdn -Username $username -Password $password -NoGroups:$noGroups

                # if there's a message, fail and return the message
                if (!(Test-IsEmpty $result.Message)) {
                    return $result
                }

                # if there's no user, then, err, oops
                if (Test-IsEmpty $result.User) {
                    return @{ Message = 'An unexpected error occured' }
                }

                # if there are no groups/users supplied, return the user
                if ((Test-IsEmpty $options.Users) -and (Test-IsEmpty $options.Groups)){
                    return $result
                }

                # before checking supplied groups, is the user in the supplied list of authorised users?
                if (!(Test-IsEmpty $options.Users) -and (@($options.Users) -icontains $result.User.Username)) {
                    return $result
                }

                # if there are groups supplied, check the user is a member of one
                if (!(Test-IsEmpty $options.Groups)) {
                    foreach ($group in $options.Groups) {
                        if (@($result.User.Groups) -icontains $group) {
                            return $result
                        }
                    }
                }

                # else, they shall not pass!
                return @{ Message = 'You are not authorised to access this website' }
            }
        }
    }

    return $script
}

function Get-PodeAuthMiddlewareScript
{
    return {
        param($e, $opts)

        # route options for using sessions
        $storeInSession = !$opts.Sessionless
        $usingSessions = (!(Test-IsEmpty $e.Session))

        # check for logout command
        if ($opts.Logout) {
            Remove-PodeAuthSession -Event $e
            $opts.Failure.Url = (Protect-PodeValue -Value $opts.Failure.Url -Default $e.Request.Url.AbsolutePath)
            return (Set-PodeAuthStatus -StatusCode 302 -Options $opts)
        }

        # if the session already has a user/isAuth'd, then skip auth
        if ($usingSessions -and !(Test-IsEmpty $e.Session.Data.Auth.User) -and $e.Session.Data.Auth.IsAuthenticated) {
            $e.Auth = $e.Session.Data.Auth
            return (Set-PodeAuthStatus -Options $opts)
        }

        # check if the auto-login flag is set, in which case just return
        if ($opts.AutoLogin) {
            if (!(Test-IsEmpty $e.Session.Data.Auth)) {
                Remove-PodeSessionCookie -Session $e.Session
            }

            return $true
        }

        # get the auth method
        $auth = $PodeContext.Server.Authentications[$opts.Name]

        try {
            # run auth type script to parse request for data
            $result = (Invoke-PodeScriptBlock -ScriptBlock $auth.Type.ScriptBlock -Arguments (@($e) + @($auth.Type.Arguments)) -Return -Splat)

            # if data is a hashtable, then don't call validator (parser either failed, or forced a success)
            if ($result -isnot [hashtable]) {
                $result = (Invoke-PodeScriptBlock -ScriptBlock $auth.ScriptBlock -Arguments (@($result) + @($auth.Arguments)) -Return -Splat)
            }
        }
        catch {
            $_ | Write-PodeErrorLog
            return (Set-PodeAuthStatus -StatusCode 500 -Description $_.Exception.Message -Options $opts)
        }

        # if there is no result, return false (failed auth)
        if ((Test-IsEmpty $result) -or (Test-IsEmpty $result.User)) {
            $_code = (Protect-PodeValue -Value $result.Code -Default 401)

            # set the www-auth header
            if (($_code -eq 401) -and (($null -eq $result.Headers) -or !$result.Headers.ContainsKey('WWW-Authenticate'))) {
                $_wwwHeader = Get-PodeAuthWwwHeaderValue -Name $auth.Type.Name -Realm $auth.Type.Realm
                if (![string]::IsNullOrWhiteSpace($_wwwHeader)) {
                    Set-PodeHeader -Name 'WWW-Authenticate' -Value $_wwwHeader
                }
            }

            return (Set-PodeAuthStatus `
                -StatusCode $_code `
                -Description $result.Message `
                -Headers $result.Headers `
                -Options $opts)
        }

        # assign the user to the session, and wire up a quick method
        $e.Auth = @{}
        $e.Auth.User = $result.User
        $e.Auth.IsAuthenticated = $true
        $e.Auth.Store = $storeInSession

        # continue
        return (Set-PodeAuthStatus -Headers $result.Headers -Options $opts)
    }
}

function Get-PodeAuthWwwHeaderValue
{
    param(
        [Parameter()]
        [string]
        $Name,

        [Parameter()]
        [string]
        $Realm
    )

    if ([string]::IsNullOrWhiteSpace($Name)) {
        return [string]::Empty
    }

    $header = $Name
    if (![string]::IsNullOrWhiteSpace($Realm)) {
        $header += " realm=`"$($Realm)`""
    }

    return $header
}

function Remove-PodeAuthSession
{
    param (
        [Parameter(Mandatory=$true)]
        [ValidateNotNull()]
        $Event
    )

    # blank out the auth
    $Event.Auth = @{}

    # if a session auth is found, blank it
    if (!(Test-IsEmpty $Event.Session.Data.Auth)) {
        $Event.Session.Data.Remove('Auth')
    }

    # Delete the session (remove from store, blank it, and remove from Response)
    Remove-PodeSessionCookie -Session $Event.Session
}

function Set-PodeAuthStatus
{
    param (
        [Parameter()]
        [int]
        $StatusCode = 0,

        [Parameter()]
        [string]
        $Description,

        [Parameter()]
        [hashtable]
        $Headers,

        [Parameter()]
        [hashtable]
        $Options
    )

    # if we have any headers, set them
    if (($null -ne $Headers) -and ($Headers.Count -gt 0)) {
        foreach ($name in $Headers.Keys) {
            Set-PodeHeader -Name $name -Value $Headers[$name]
        }
    }

    # if a statuscode supplied, assume failure
    if ($StatusCode -gt 0)
    {
        # override description with the failureMessage if supplied
        $Description = (Protect-PodeValue -Value $Options.Failure.Message -Default $Description)

        # add error to flash if flagged
        if ($Options.Failure.FlashEnabled) {
            Add-PodeFlashMessage -Name 'auth-error' -Message $Description
        }

        # check if we have a failure url redirect
        if (![string]::IsNullOrWhiteSpace($Options.Failure.Url)) {
            Move-PodeResponseUrl -Url $Options.Failure.Url
        }
        else {
            Set-PodeResponseStatus -Code $StatusCode -Description $Description
        }

        return $false
    }

    # if no statuscode, success, so check if we have a success url redirect
    if (![string]::IsNullOrWhiteSpace($Options.Success.Url)) {
        Move-PodeResponseUrl -Url $Options.Success.Url
        return $false
    }

    return $true
}

function Get-PodeAuthADUser
{
    param (
        [Parameter()]
        [string]
        $Fqdn,

        [Parameter()]
        [string]
        $Username,

        [Parameter()]
        [string]
        $Password,

        [switch]
        $NoGroups
    )

    try
    {
        # setup the dns domain
        $Fqdn = Protect-PodeValue -Value $Fqdn -Default $env:USERDNSDOMAIN

        # validate the user's AD creds
        $ad = (New-Object System.DirectoryServices.DirectoryEntry "LDAP://$($Fqdn)", "$($Username)", "$($Password)")
        if (Test-IsEmpty $ad.distinguishedName) {
            return @{ Message = 'Invalid credentials supplied' }
        }

        # generate query to find user/groups
        $query = New-Object System.DirectoryServices.DirectorySearcher $ad
        $query.filter = "(&(objectCategory=person)(samaccountname=$($Username)))"

        $user = $query.FindOne().Properties
        if (Test-IsEmpty $user) {
            return @{ Message = 'User not found in Active Directory' }
        }

        # get the users groups
        $groups =@()
        if (!$NoGroups) {
            $groups = Get-PodeAuthADGroups -Query $query -CategoryName $Username -CategoryType 'person'
        }

        # return the user
        return @{
            User = @{
                Username = $Username
                Name = @($user.name)[0]
                Fqdn = $Fqdn
                Groups = $groups
            }
        }
    }
    finally {
        if (!(Test-IsEmpty $ad.distinguishedName)) {
            Close-PodeDisposable -Disposable $query
            Close-PodeDisposable -Disposable $ad -Close
        }
    }
}

function Get-PodeAuthADGroups
{
    param (
        [Parameter(Mandatory=$true)]
        [System.DirectoryServices.DirectorySearcher]
        $Query,

        [Parameter(Mandatory=$true)]
        [string]
        $CategoryName,

        [Parameter(Mandatory=$true)]
        [ValidateSet('group', 'person')]
        [string]
        $CategoryType,

        [Parameter()]
        [hashtable]
        $GroupsFound = $null
    )

    # setup found groups
    if ($null -eq $GroupsFound) {
        $GroupsFound = @{}
    }

    # get the groups for the category
    $Query.filter = "(&(objectCategory=$($CategoryType))(samaccountname=$($CategoryName)))"

    $groups = @{}
    foreach ($member in $Query.FindOne().Properties.memberof) {
        if ($member -imatch '^CN=(?<group>.+?),') {
            $g = $Matches['group']
            $groups[$g] = ($member -imatch '=builtin,')
        }
    }

    foreach ($group in $groups.Keys) {
        # don't bother if we've already looked up the group
        if ($GroupsFound.ContainsKey($group)) {
            continue
        }

        # add group to checked groups
        $GroupsFound[$group] = $true

        # don't bother if it's inbuilt
        if ($groups[$group]) {
            continue
        }

        # get the groups
        Get-PodeAuthADGroups -Query $Query -CategoryName $group -CategoryType 'group' -GroupsFound $GroupsFound
    }

    if ($CategoryType -ieq 'person') {
        return $GroupsFound.Keys
    }
}

1	function Get-PodeAuthBasicType
2	{
3	return {	×
4	param($e, $options)
5
6	# get the auth header
7	$header = (Get-PodeHeader -Name 'Authorization')	×
8	if ($null -eq $header) {	×
9	return @{	×
10	Message = 'No Authorization header found'	×
11	Code = 401	×
12	}
13	}
14
15	# ensure the first atom is basic (or opt override)
16	$atoms = $header -isplit '\s+'	×
17	if ($atoms[0] -ine $options.HeaderTag) {	×
18	return @{	×
19	Message = "Header is not for $($options.HeaderTag) Authorization"	×
20	Code = 400	×
21	}
22	}
23
24	# decode the auth header
25	try {
26	$enc = [System.Text.Encoding]::GetEncoding($options.Encoding)	×
27	}
28	catch {
29	return @{	×
30	Message = 'Invalid encoding specified for Authorization'	×
31	Code = 400	×
32	}
33	}
34
35	try {
36	$decoded = $enc.GetString([System.Convert]::FromBase64String($atoms[1]))	×
37	}
38	catch {
39	return @{	×
40	Message = 'Invalid Base64 string found in Authorization header'	×
41	Code = 400	×
42	}
43	}
44
45	# validate and return user/result
46	$index = $decoded.IndexOf(':')	×
47	$username = $decoded.Substring(0, $index)	×
48	$password = $decoded.Substring($index + 1)	×
49
50	# return data for calling validator
51	return @($username, $password)	×
52	}
53	}
54
55	function Get-PodeAuthFormType
56	{
57	return {	×
58	param($e, $options)
59
60	# get user/pass keys to get from payload
61	$userField = $options.Fields.Username	×
62	$passField = $options.Fields.Password	×
63
64	# get the user/pass
65	$username = $e.Data.$userField	×
66	$password = $e.Data.$passField	×
67
68	# if either are empty, fail auth
69	if ([string]::IsNullOrWhiteSpace($username) -or [string]::IsNullOrWhiteSpace($password)) {	×
70	return @{	×
71	Message = 'Username or Password not supplied'	×
72	Code = 401	×
73	}
74	}
75
76	# return data for calling validator
77	return @($username, $password)	×
78	}
79	}
80
81	function Get-PodeAuthInbuiltMethod
82	{
83	param (
84	[Parameter(Mandatory=$true)]
85	[ValidateSet('WindowsAd')]
86	[string]
87	$Type
88	)
89
90	switch ($Type.ToLowerInvariant())	2✔
91	{
92	'windowsad' {
93	$script = {	×
94	param($username, $password, $options)
95
96	# validate and retrieve the AD user
97	$noGroups = $options.NoGroups	×
98	$result = Get-PodeAuthADUser -Fqdn $options.Fqdn -Username $username -Password $password -NoGroups:$noGroups	×
99
100	# if there's a message, fail and return the message
101	if (!(Test-IsEmpty $result.Message)) {	×
102	return $result	×
103	}
104
105	# if there's no user, then, err, oops
106	if (Test-IsEmpty $result.User) {	×
107	return @{ Message = 'An unexpected error occured' }	×
108	}
109
110	# if there are no groups/users supplied, return the user
111	if ((Test-IsEmpty $options.Users) -and (Test-IsEmpty $options.Groups)){	×
112	return $result	×
113	}
114
115	# before checking supplied groups, is the user in the supplied list of authorised users?
116	if (!(Test-IsEmpty $options.Users) -and (@($options.Users) -icontains $result.User.Username)) {	×
117	return $result	×
118	}
119
120	# if there are groups supplied, check the user is a member of one
121	if (!(Test-IsEmpty $options.Groups)) {	×
122	foreach ($group in $options.Groups) {	×
123	if (@($result.User.Groups) -icontains $group) {	×
124	return $result	×
125	}
126	}
127	}
128
129	# else, they shall not pass!
130	return @{ Message = 'You are not authorised to access this website' }	×
131	}
132	}
133	}
134
135	return $script	2✔
136	}
137
138	function Get-PodeAuthMiddlewareScript
139	{
140	return {	×
141	param($e, $opts)
142
143	# route options for using sessions
144	$storeInSession = !$opts.Sessionless	×
145	$usingSessions = (!(Test-IsEmpty $e.Session))	×
146
147	# check for logout command
148	if ($opts.Logout) {	×
149	Remove-PodeAuthSession -Event $e	×
150	$opts.Failure.Url = (Protect-PodeValue -Value $opts.Failure.Url -Default $e.Request.Url.AbsolutePath)	×
151	return (Set-PodeAuthStatus -StatusCode 302 -Options $opts)	×
152	}
153
154	# if the session already has a user/isAuth'd, then skip auth
155	if ($usingSessions -and !(Test-IsEmpty $e.Session.Data.Auth.User) -and $e.Session.Data.Auth.IsAuthenticated) {	×
156	$e.Auth = $e.Session.Data.Auth	×
157	return (Set-PodeAuthStatus -Options $opts)	×
158	}
159
160	# check if the auto-login flag is set, in which case just return
161	if ($opts.AutoLogin) {	×
162	if (!(Test-IsEmpty $e.Session.Data.Auth)) {	×
163	Remove-PodeSessionCookie -Session $e.Session	×
164	}
165
166	return $true	×
167	}
168
169	# get the auth method
170	$auth = $PodeContext.Server.Authentications[$opts.Name]	×
171
172	try {
173	# run auth type script to parse request for data
174	$result = (Invoke-PodeScriptBlock -ScriptBlock $auth.Type.ScriptBlock -Arguments (@($e) + @($auth.Type.Arguments)) -Return -Splat)	×
175
176	# if data is a hashtable, then don't call validator (parser either failed, or forced a success)
177	if ($result -isnot [hashtable]) {	×
178	$result = (Invoke-PodeScriptBlock -ScriptBlock $auth.ScriptBlock -Arguments (@($result) + @($auth.Arguments)) -Return -Splat)	×
179	}
180	}
181	catch {
182	$_ \| Write-PodeErrorLog	×
183	return (Set-PodeAuthStatus -StatusCode 500 -Description $_.Exception.Message -Options $opts)	×
184	}
185
186	# if there is no result, return false (failed auth)
187	if ((Test-IsEmpty $result) -or (Test-IsEmpty $result.User)) {	×
188	$_code = (Protect-PodeValue -Value $result.Code -Default 401)	×
189
190	# set the www-auth header
191	if (($_code -eq 401) -and (($null -eq $result.Headers) -or !$result.Headers.ContainsKey('WWW-Authenticate'))) {	×
192	$_wwwHeader = Get-PodeAuthWwwHeaderValue -Name $auth.Type.Name -Realm $auth.Type.Realm	×
193	if (![string]::IsNullOrWhiteSpace($_wwwHeader)) {	×
194	Set-PodeHeader -Name 'WWW-Authenticate' -Value $_wwwHeader	×
195	}
196	}
197
198	return (Set-PodeAuthStatus `	×
199	-StatusCode $_code `
200	-Description $result.Message `
201	-Headers $result.Headers `
202	-Options $opts)
203	}
204
205	# assign the user to the session, and wire up a quick method
206	$e.Auth = @{}	×
207	$e.Auth.User = $result.User	×
208	$e.Auth.IsAuthenticated = $true	×
209	$e.Auth.Store = $storeInSession	×
210
211	# continue
212	return (Set-PodeAuthStatus -Headers $result.Headers -Options $opts)	×
213	}
214	}
215
216	function Get-PodeAuthWwwHeaderValue
217	{
218	param(
219	[Parameter()]
220	[string]
221	$Name,
222
223	[Parameter()]
224	[string]
225	$Realm
226	)
227
228	if ([string]::IsNullOrWhiteSpace($Name)) {	×
229	return [string]::Empty	×
230	}
231
232	$header = $Name	×
233	if (![string]::IsNullOrWhiteSpace($Realm)) {	×
234	$header += " realm=`"$($Realm)`""	×
235	}
236
237	return $header	×
238	}
239
240	function Remove-PodeAuthSession
241	{
242	param (
243	[Parameter(Mandatory=$true)]
244	[ValidateNotNull()]
245	$Event
246	)
247
248	# blank out the auth
249	$Event.Auth = @{}	2✔
250
251	# if a session auth is found, blank it
252	if (!(Test-IsEmpty $Event.Session.Data.Auth)) {	4✔
253	$Event.Session.Data.Remove('Auth')	2✔
254	}
255
256	# Delete the session (remove from store, blank it, and remove from Response)
257	Remove-PodeSessionCookie -Session $Event.Session	2✔
258	}
259
260	function Set-PodeAuthStatus
261	{
262	param (
263	[Parameter()]
264	[int]
265	$StatusCode = 0,
266
267	[Parameter()]
268	[string]
269	$Description,
270
271	[Parameter()]
272	[hashtable]
273	$Headers,
274
275	[Parameter()]
276	[hashtable]
277	$Options
278	)
279
280	# if we have any headers, set them
281	if (($null -ne $Headers) -and ($Headers.Count -gt 0)) {	6✔
282	foreach ($name in $Headers.Keys) {	×
283	Set-PodeHeader -Name $name -Value $Headers[$name]	×
284	}
285	}
286
287	# if a statuscode supplied, assume failure
288	if ($StatusCode -gt 0)	2✔
289	{
290	# override description with the failureMessage if supplied
291	$Description = (Protect-PodeValue -Value $Options.Failure.Message -Default $Description)	4✔
292
293	# add error to flash if flagged
294	if ($Options.Failure.FlashEnabled) {	2✔
295	Add-PodeFlashMessage -Name 'auth-error' -Message $Description	×
296	}
297
298	# check if we have a failure url redirect
299	if (![string]::IsNullOrWhiteSpace($Options.Failure.Url)) {	2✔
300	Move-PodeResponseUrl -Url $Options.Failure.Url	2✔
301	}
302	else {
303	Set-PodeResponseStatus -Code $StatusCode -Description $Description	2✔
304	}
305
306	return $false	2✔
307	}
308
309	# if no statuscode, success, so check if we have a success url redirect
310	if (![string]::IsNullOrWhiteSpace($Options.Success.Url)) {	2✔
311	Move-PodeResponseUrl -Url $Options.Success.Url	2✔
312	return $false	2✔
313	}
314
315	return $true	2✔
316	}
317
318	function Get-PodeAuthADUser
319	{
320	param (
321	[Parameter()]
322	[string]
323	$Fqdn,
324
325	[Parameter()]
326	[string]
327	$Username,
328
329	[Parameter()]
330	[string]
331	$Password,
332
333	[switch]
334	$NoGroups
335	)
336
337	try
338	{
339	# setup the dns domain
340	$Fqdn = Protect-PodeValue -Value $Fqdn -Default $env:USERDNSDOMAIN	×
341
342	# validate the user's AD creds
343	$ad = (New-Object System.DirectoryServices.DirectoryEntry "LDAP://$($Fqdn)", "$($Username)", "$($Password)")	×
344	if (Test-IsEmpty $ad.distinguishedName) {	×
345	return @{ Message = 'Invalid credentials supplied' }	×
346	}
347
348	# generate query to find user/groups
349	$query = New-Object System.DirectoryServices.DirectorySearcher $ad	×
350	$query.filter = "(&(objectCategory=person)(samaccountname=$($Username)))"	×
351
352	$user = $query.FindOne().Properties	×
353	if (Test-IsEmpty $user) {	×
354	return @{ Message = 'User not found in Active Directory' }	×
355	}
356
357	# get the users groups
358	$groups =@()	×
359	if (!$NoGroups) {	×
360	$groups = Get-PodeAuthADGroups -Query $query -CategoryName $Username -CategoryType 'person'	×
361	}
362
363	# return the user
364	return @{	×
365	User = @{	×
366	Username = $Username	×
367	Name = @($user.name)[0]	×
368	Fqdn = $Fqdn	×
369	Groups = $groups	×
370	}
371	}
372	}
373	finally {
374	if (!(Test-IsEmpty $ad.distinguishedName)) {	×
375	Close-PodeDisposable -Disposable $query	×
376	Close-PodeDisposable -Disposable $ad -Close	×
377	}
378	}
379	}
380
381	function Get-PodeAuthADGroups
382	{
383	param (
384	[Parameter(Mandatory=$true)]
385	[System.DirectoryServices.DirectorySearcher]
386	$Query,
387
388	[Parameter(Mandatory=$true)]
389	[string]
390	$CategoryName,
391
392	[Parameter(Mandatory=$true)]
393	[ValidateSet('group', 'person')]
394	[string]
395	$CategoryType,
396
397	[Parameter()]
398	[hashtable]
399	$GroupsFound = $null
400	)
401
402	# setup found groups
403	if ($null -eq $GroupsFound) {	×
404	$GroupsFound = @{}	×
405	}
406
407	# get the groups for the category
408	$Query.filter = "(&(objectCategory=$($CategoryType))(samaccountname=$($CategoryName)))"	×
409
410	$groups = @{}	×
411	foreach ($member in $Query.FindOne().Properties.memberof) {	×
412	if ($member -imatch '^CN=(?<group>.+?),') {	×
413	$g = $Matches['group']	×
414	$groups[$g] = ($member -imatch '=builtin,')	×
415	}
416	}
417
418	foreach ($group in $groups.Keys) {	×
419	# don't bother if we've already looked up the group
420	if ($GroupsFound.ContainsKey($group)) {	×
421	continue
422	}
423
424	# add group to checked groups
425	$GroupsFound[$group] = $true	×
426
427	# don't bother if it's inbuilt
428	if ($groups[$group]) {	×
429	continue
430	}
431
432	# get the groups
433	Get-PodeAuthADGroups -Query $Query -CategoryName $group -CategoryType 'group' -GroupsFound $GroupsFound	×
434	}
435
436	if ($CategoryType -ieq 'person') {	×
437	return $GroupsFound.Keys	×
438	}
439	}

Badgerati / Pode / #497

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous