Question

我有一份由HR提供的有效用户的列表。格式不是很酷，所以我设法得到一个想要的新文件：一行，每行上有一个samaccountname（名字和名字的第一个字母）。

我的文件如下：

bgates
sjobs
bmarley
epresley
etc.

我想禁用不在此列表中的用户。我想我必须处理一些@Provider @Priority(Priorities.AUTHENTICATION) public class AuthenticationFilter implements ContainerRequestFilter { @Context private ResourceInfo resourceInfo; private static final String AUTHORIZATION_PROPERTY = "Authorization"; private static final String AUTHENTICATION_SCHEME = "Basic"; private static final Response ACCESS_DENIED = Response.status(Response.Status.UNAUTHORIZED) .entity("You cannot access this resource").build(); private static final Response ACCESS_FORBIDDEN = Response.status(Response.Status.FORBIDDEN) .entity("Access blocked for all users !!").build(); @Override public void filter(ContainerRequestContext requestContext) { System.out.println("filter ContainerRequestContext"); Method method = resourceInfo.getResourceMethod(); //Access allowed for all if( ! method.isAnnotationPresent(PermitAll.class)) { //Access denied for all if(method.isAnnotationPresent(DenyAll.class)) { requestContext.abortWith(ACCESS_FORBIDDEN); return; } //Get request headers final MultivaluedMap<String, String> headers = requestContext.getHeaders(); //Fetch authorization header final List<String> authorization = headers.get(AUTHORIZATION_PROPERTY); //If no authorization information present; block access if(authorization == null || authorization.isEmpty()) { requestContext.abortWith(ACCESS_DENIED); return; } //Get encoded username and password final String encodedUserPassword = authorization.get(0).replaceFirst(AUTHENTICATION_SCHEME + " ", ""); //Decode username and password //String usernameAndPassword = new String(Base64.decode(encodedUserPassword.getBytes()));; String usernameAndPassword = new String(Base64.decode(encodedUserPassword));; //Split username and password tokens final StringTokenizer tokenizer = new StringTokenizer(usernameAndPassword, ":"); final String username = tokenizer.nextToken(); final String password = tokenizer.nextToken(); //Verifying Username and password System.out.println(username); System.out.println(password); //Verify user access if(method.isAnnotationPresent(RolesAllowed.class)) { RolesAllowed rolesAnnotation = method.getAnnotation(RolesAllowed.class); Set<String> rolesSet = new HashSet<String>(Arrays.asList(rolesAnnotation.value())); //Is user valid? if( ! isUserAllowed(username, password, rolesSet)) { requestContext.abortWith(ACCESS_DENIED); return; } } } } private boolean isUserAllowed(final String username, final String password, final Set<String> rolesSet) { System.out.println("filter isUserAllowed"); boolean isAllowed = false; //Step 1. Fetch password from database and match with password in argument //If both match then get the defined role for user from database and continue; else return isAllowed [false] //Access the database and do this part yourself //String userRole = userMgr.getUserRole(username); if(username.equals("password") && password.equals("password")) { isAllowed = true; } return isAllowed; } }的东西，但是我不知道该怎么办。

@HariHaran，我已经尝试过：



      #this part works fine
        $list = Import-Csv .\listadnames2.csv -Delimiter ";"

        $lol =

        ForEach ($user in $list)
        {

         $user.prenom[0] + $user.nom 

        }  

        $lol | Out-File .\samaccountnames.csv 

        $validusers = Import-Csv .\samaccountnames.csv
        $fullusers = Get-ADUser -Filter * -SearchBase "OU=USERS,DC=domain,DC=com" -ResultPageSize 0 -Prop samaccountname | Select samaccountname

        foreach ($u in $validusers)

        if ($u -match $fullusers) {continue} else 

        {
        Set-ADUser -Identity $($._) -Enabled $false -whatif
        }

Answer 1

您在$lol中创建的用户列表（samaccountnames.csv）不是CSV文件，而只是一个文本文件，所有构造的用户名均位于单独的行中。
因此，您应该使用 $validusers = Get-Content .\samaccountnames.csv，而不是$validusers = Import-Csv .\samaccountnames.csv。
然后，您将具有一系列的samaccountnames。

接下来，我想知道为什么您使用-ResultPageSize 0。默认设置是每页256个对象，所以我只能想象您需要该值大于此默认值，而不是小于此值。（请参阅the docs）

从阅读samaccountnames文件的部分来看，我认为这可以完成工作：

$validusers = Get-Content .\samaccountnames.csv
# property 'SamAccountName' is returned by default as are 
# 'DistinguishedName', 'Enabled', 'GivenName', 'Name', 'ObjectClass', 'ObjectGUID', 'SID', 'Surname' and 'UserPrincipalName'

# get the user objects from AD and loop through them to see if they need to be set disabled
Get-ADUser -Filter * -SearchBase "OU=USERS,DC=domain,DC=com" | ForEach-Object {
    # the $_ automatic variable now holds an AD user object

    # or use if($_.SamAccountName -notin $validusers). Only for PowerShell version 3.0 and up
    if ($validusers -notcontains $_.SamAccountName) {  
        $_ | Set-ADUser -Enabled $false -WhatIf
    }
}

从有效列表中禁用用户

1 个答案: