-
タイトル
HOW TO: Determine which Active Roles client is performing a modification using a custom script module -
説明
In some circumstances, if may be necessary to only run custom code if a specific Active Roles client is being used. -
原因
The Active Roles Console has a unique name in its ClientVersion which can be used to determine if it is being used.
The Active Roles Web Interface uses the ADSI Provider, and therefore does not have a unique ClientVersion. However, it is possible to leverage a custom Active Roles Control to stamp traffic coming from a Web Interface form.
The Active Roles Synchronization Service has a built-in Active Roles control which is populated with the version of the Active Roles Synchronization Service instance which is performing the modification.
-
対策
Any Active Roles Web Interface form can be modified so that requests sent from that form contain a custom Active Roles Control.
- In the Active Roles Web Interface, as an Active Roles Admin, find the desired form
- Click on Customize in the top right-hand corner
- Click on Properties in the top right-hand corner
- Click on the Extended Control tab
- Choose a name for this custom Active Roles Control. This can be anything, such as fromWeb
- Set the Control Value to TRUE and click the Add button and then click Save
- Expand Customization on the left and click Reload to post the changes to the Web Interface configuration.
After this customization is performed, leverage a script module similar to the one below in order to distinguish between updates from each of these Active Roles clients:
function onPostModify($Request){if ($Request.class -eq "user"){#Load the current session, only necessary for Active Roles Console detection$Session = $Security.Sessions.Currentif ($Session.ClientVersion -like "MMC*"){"From the Active Roles Console" | Out-File -FilePath C:\Temp\clientTraffic.txt -Append}try{$FromARSS = $Request.GetInControl("ActiveRolesSyncService")#Builtin control, no modification necessaryif ($FromARSS)#Testing to see if it has a value. The specific value will be the the full version of the Active Roles Synchronization Service as shown in Active Roles Synchronization Service Console.{"From the Active Roles Synchronization Service" | Out-File -FilePath C:\Temp\clientTraffic.txt -Append}}catch{#alternate code if desired}try{$FromWeb = $Request.GetInControl("fromWeb")#Custom control, modification in the Active Roles Web Interface is necessaryif ($FromWeb){"From the Active Roles Web Interface" | Out-File -FilePath C:\Temp\clientTraffic.txt -Append}}catch{#alternate code if desired}}}