Extended permissions fix

dsccommunity · Feb 3, 2020 · 017e892 · 017e892
1 parent 07b70f8
commit 017e892
Show file tree

Hide file tree

Showing 2 changed files with 22 additions and 18 deletions.
diff --git a/source/DSCResources/MSFT_xExchReceiveConnector/MSFT_xExchReceiveConnector.psm1 b/source/DSCResources/MSFT_xExchReceiveConnector/MSFT_xExchReceiveConnector.psm1
@@ -1180,7 +1180,7 @@ function Test-TargetResource
                 $testResults = $false
             }
 
-            if ($ExtendedRightAllowEntries -and $adPermissions.Deny -contains $false)
+            if ($ExtendedRightAllowEntries)
             {
                 $splat = @{
                     ADPermissions  = $adPermissions
@@ -1196,11 +1196,7 @@ function Test-TargetResource
                     $testResults = $false
                 }
             }
-            if (-not $ExtendedRightAllowEntries -and $adPermissions -and $adPermissions.Deny -notcontains $false)
-            {
-                return $false
-            }
-            if ($ExtendedRightDenyEntries -and $adPermissions.Deny -contains $true)
+            if ($ExtendedRightDenyEntries)
             {
                 $splat = @{
                     ADPermissions  = $adPermissions
@@ -1216,10 +1212,6 @@ function Test-TargetResource
                     $testResults = $false
                 }
             }
-            if (-not $ExtendedRightDenyEntries -and $adPermissions -and $adPermissions.Deny -contains $true)
-            {
-                return $false
-            }
         }
     }
 
@@ -1268,8 +1260,8 @@ function Test-ExtendedRightsPresent
             $permissionsFound = $ADPermissions | Where-Object { ($_.User.RawIdentity -match $Right.Key) -and ($_.ExtendedRights.RawIdentity -eq $Value) }
             if ($null -ne $permissionsFound)
             {
-                if ($Deny -eq $true -and $permissionsFound.Deny -eq $false -or
-                    $Deny -eq $false -and $permissionsFound.Deny -eq $true)
+                if (($Deny -eq $true -and $permissionsFound.Deny.ToBool() -eq $false) -or
+                    ($Deny -eq $false -and $permissionsFound.Deny.ToBool() -eq $true))
                 {
                     Write-InvalidSettingVerbose -SettingName 'ExtendedRight' -ExpectedValue "User:$($Right.Key) Value:$Value" -ActualValue "Deny: $($permissionsFound.Deny)" -Verbose:$VerbosePreference
                     return $false

diff --git a/tests/Unit/MSFT_xExchReceiveConnector.tests.ps1 b/tests/Unit/MSFT_xExchReceiveConnector.tests.ps1
@@ -371,7 +371,7 @@ try
                         User           = [PSCustomObject] @{
                             RawIdentity = 'User1Allow'
                         }
-                        Deny           = $false
+                        Deny           = [System.Management.Automation.SwitchParameter]::new($false)
                         ExtendedRights = [PSCustomObject] @{
                             RawIdentity = 'ms-Exch-SMTP-Accept-Any-Recipient'
                         }
@@ -383,7 +383,7 @@ try
                         User           = [PSCustomObject] @{
                             RawIdentity = 'User1Allow'
                         }
-                        Deny           = $false
+                        Deny           = [System.Management.Automation.SwitchParameter]::new($false)
                         ExtendedRights = [PSCustomObject] @{
                             RawIdentity = 'ms-Exch-SMTP-Accept-Any-Sender'
                         }
@@ -395,7 +395,7 @@ try
                         User           = [PSCustomObject] @{
                             RawIdentity = 'User2Deny'
                         }
-                        Deny           = $true
+                        Deny           = [System.Management.Automation.SwitchParameter]::new($true)
                         ExtendedRights = [PSCustomObject] @{
                             RawIdentity = 'ms-Exch-SMTP-Accept-Any-Recipient'
                         }
@@ -407,7 +407,7 @@ try
                         User           = [PSCustomObject] @{
                             RawIdentity = 'User2Deny'
                         }
-                        Deny           = $true
+                        Deny           = [System.Management.Automation.SwitchParameter]::new($true)
                         ExtendedRights = [PSCustomObject] @{
                             RawIdentity = 'ms-Exch-SMTP-Accept-Any-Sender'
                         }
@@ -416,8 +416,19 @@ try
 
                     Mock -CommandName 'Get-ADPermission' -MockWith { return $ADPermissions }
 
-                    Context 'When permissions do not match' {
-                        It 'Should return $false' {
+                    Context 'When permissions are not compliant' {
+                        It 'Should return $false when extended permissions do not match' {
+                            $TestTargetResourceParamsFalse = @{ } + $TestTargetResourceParams
+                            $TestTargetResourceParamsFalse['ExtendedRightAllowEntries'] = (
+                                New-CimInstance -ClassName 'MSFT_KeyValuePair' -Property @{
+                                    key   = 'User1Allow'
+                                    value = 'ms-Exch-SMTP-Accept-Any-Recipient,ms-Exch-SMTP-Accept-Authoritative-Domain-Sender'
+                                } -ClientOnly
+                            )
+
+                            Test-TargetResource @TestTargetResourceParamsFalse | Should -Be $false
+                        }
+                        It 'Should return $false when permissions are not present' {
                             $TestTargetResourceParamsFalse = @{ } + $TestTargetResourceParams
                             $TestTargetResourceParamsFalse['ExtendedRightAllowEntries'] = (
                                 New-CimInstance -ClassName 'MSFT_KeyValuePair' -Property @{
@@ -426,6 +437,7 @@ try
                                 } -ClientOnly
                             )
 
+                            Mock -CommandName 'Get-ADPermission' -MockWith { return ($ADPermissions | Where-Object -FilterScript { $_.User.RawIdentity -eq 'User2Deny' }) }
                             Test-TargetResource @TestTargetResourceParamsFalse | Should -Be $false
                         }
                     }