Modules/SharePointDsc.WebAppPolicy/SPWebAppPolicy.psm1
|
function Assert-SPDscPolicyUser() { param ( [Parameter()] [Array] $CurrentDifferences, [Parameter(Mandatory = $true)] [String] $UsernameToCheck ) foreach ($difference in $CurrentDifferences) { if ($difference.ContainsKey($UsernameToCheck)) { return $true } } return $false } function Compare-SPDscWebAppPolicy() { param ( [Parameter(Mandatory = $true)] [Array] $WAPolicies, [Parameter(Mandatory = $true)] [Array] $DSCSettings, [Parameter(Mandatory = $true)] [String] $DefaultIdentityType ) Import-Module -Name (Join-Path -Path $PSScriptRoot ` -ChildPath "..\SharePointDsc.Util\SharePointDsc.Util.psm1" ` -Resolve) $diff = @() foreach ($policy in $WAPolicies) { $memberexists = $false foreach ($setting in $DSCSettings) { $identityType = $DefaultIdentityType if ((Test-SPDscObjectHasProperty -Object $setting ` -PropertyName "IdentityType") -eq $true) { $identityType = $setting.IdentityType } if (($policy.Username -eq $setting.Username) -and ` ($policy.IdentityType -eq $identityType)) { $memberexists = $true $polbinddiff = Compare-Object -ReferenceObject $policy.PermissionLevel.ToLower() ` -DifferenceObject $setting.PermissionLevel.ToLower() if ($null -ne $polbinddiff) { Write-Verbose -Message ("Permission level different for " + ` "$($policy.IdentityType) user '$($policy.Username)'") if (-not (Assert-SPDscPolicyUser -CurrentDifferences $diff ` -UsernameToCheck $policy.Username.ToLower())) { $diff += @{ Username = $policy.Username.ToLower() Status = "Different" IdentityType = $policy.IdentityType DesiredPermissionLevel = $setting.PermissionLevel DesiredActAsSystemSetting = $setting.ActAsSystemAccount } } } if ($setting.ActAsSystemAccount) { if ($policy.ActAsSystemAccount -ne $setting.ActAsSystemAccount) { Write-Verbose -Message ("System User different for " + ` "$($policy.IdentityType) user '$($policy.Username)'") if (-not (Assert-SPDscPolicyUser -CurrentDifferences $diff ` -UsernameToCheck $policy.Username.ToLower())) { $diff += @{ Username = $policy.Username.ToLower() Status = "Different" IdentityType = $policy.IdentityType DesiredPermissionLevel = $setting.PermissionLevel DesiredActAsSystemSetting = $setting.ActAsSystemAccount } } } } } } if (-not $memberexists) { if (-not (Assert-SPDscPolicyUser -CurrentDifferences $diff ` -UsernameToCheck $policy.Username.ToLower())) { $diff += @{ Username = $policy.Username.ToLower() Status = "Additional" IdentityType = $policy.IdentityType DesiredPermissionLevel = $null DesiredActAsSystemSetting = $null } } } } foreach ($setting in $DSCSettings) { $memberexists = $false $identityType = $DefaultIdentityType if ((Test-SPDscObjectHasProperty -Object $setting -PropertyName "IdentityType") -eq $true) { $identityType = $setting.IdentityType } foreach ($policy in $WAPolicies) { if (($policy.Username -eq $setting.Username) -and ` ($policy.IdentityType -eq $identityType)) { $memberexists = $true $polbinddiff = Compare-Object -ReferenceObject $policy.PermissionLevel.ToLower() ` -DifferenceObject $setting.PermissionLevel.ToLower() if ($null -ne $polbinddiff) { Write-Verbose -Message ("Permission level different for " + ` "$($policy.IdentityType) user '$($policy.Username)'") if (-not (Assert-SPDscPolicyUser -CurrentDifferences $diff ` -UsernameToCheck $policy.Username.ToLower())) { $diff += @{ Username = $setting.Username.ToLower() Status = "Different" IdentityType = $identityType DesiredPermissionLevel = $setting.PermissionLevel DesiredActAsSystemSetting = $setting.ActAsSystemAccount } } } if ($setting.ActAsSystemAccount) { if ($policy.ActAsSystemAccount -ne $setting.ActAsSystemAccount) { Write-Verbose -Message ("System User different for " + ` "$($policy.IdentityType) user '$($policy.Username)'") if (-not (Assert-SPDscPolicyUser -CurrentDifferences $diff ` -UsernameToCheck $policy.Username.ToLower())) { $diff += @{ Username = $setting.Username.ToLower() Status = "Different" IdentityType = $identityType DesiredPermissionLevel = $setting.PermissionLevel DesiredActAsSystemSetting = $setting.ActAsSystemAccount } } } } } } if (-not $memberexists) { if (-not (Assert-SPDscPolicyUser -CurrentDifferences $diff ` -UsernameToCheck $setting.Username.ToLower())) { $diff += @{ Username = $setting.Username.ToLower() Status = "Missing" IdentityType = $identityType DesiredPermissionLevel = $setting.PermissionLevel DesiredActAsSystemSetting = $setting.ActAsSystemAccount } } } } return $diff } |