foospidy / sigsci-ad-sync

A helper script for synchronizing AD group users to SigSci site members.

sigsci-ad-sync

A helper script for synchronizing AD group users to SigSci site members.

WARNING: This script has had limited testing. Please do your own testing before running it for large synchirnizations.

Requirements

• Python 3 on Windows.
• Python dependencies are in requirements.txt, run pip install -r requirements.txt.
• Must be run on Windows with a domain user that has read access to domain groups and users.
• AD Users must have the email attribute set.
• Signal Sciences API token for a user with Corp Owner permissions.

Usage

Authentication for Signal Sciences API

Set the following environment variables (powershell example):

> $env:SIGSCI_EMAIL = "your email"
> $env:SIGSCI_API_TOKEN = "your api token"

Configure Mapping

Users and roles are synchronized based on the AD Group to SigSci site and SigSci role mappings defined in sigsci-ad-map.json.

SigSci Corp and Domain

Edit the first section of the sigsci-ad-map.json file to set your corp name and AD domain:

{
    "SigSciCorp": "corp_short_name",
    "ADDomain": "corp.foo.com",
    "GroupMappings": [
        ...
    ]
}

AD Group to SigSci Site Mappings

The next section is the GroupMappings array, add an element to the array for each ADGroup to SigSciSites with the corosponding SigSciRole. For example, if you want to synchronize all users in the AD Group "SigSci User WebDev" to the site "WebDev" with the role of "User" the GroupMappings section would be:

"GroupMappings": [
    {
        "ADGroup": "SigSci User WebDev",
        "SigSciSites": ["WebDev"],
        "SigSciRole": "user"
    }
]

If you also want to synchronize users in the AD Group "SigSci User WebDev" to the site "WebProd" with the role of "observer the GroupMappings section would be:

"GroupMappings": [
    {
        "ADGroup": "SigSci User WebDev",
        "SigSciSites": ["WebDev"],
        "SigSciRole": "user"
    },
    {
        "ADGroup": "SigSci User WebProd",
        "SigSciSites": ["WebProd"],
        "SigSciRole": "observer"
    }
]

Note the SigSciSites field is an array. This means you can specify multiple sites. For example, if you want to sync all users in AD group "SigSci Observers" to sites "Site1", "Site2", and "Site3". Example:

"GroupMappings": [
    {
        "ADGroup": "SigSci Observers",
        "SigSciSites": ["Site1", "Site2", "Site3"],
        "SigSciRole": "observer"
    }
]

You may also use the wild card * to add users of an AD Group to all sites with the specified role. Example:

"GroupMappings": [
    {
        "ADGroup": "SigSci Observers",
        "SigSciSites": ["*"],
        "SigSciRole": "observer"
    }
]

Run the script

> python sigsciad.py

Example output:

Syncing corp.foo.com to my_corp
----> Syncing users in AD group SigSci Observer All
----> Adding SigSci Observer All users to site site1
--------> Adding [e-mail] to site1 as observer
------------> Member [e-mail] does not exist.
------------> Inviting [e-mail] to site1 as observer
----> Adding SigSci Observer All users to site blamo
--------> Adding [e-mail] to blamo as observer
------------> Member [e-mail] does not exist.
------------> Inviting [e-mail] to blamo as observer
----> Adding SigSci Observer All users to site site2
--------> Adding [e-mail] to site2 as observer
------------> Member [e-mail] does not exist.
------------> Inviting [e-mail] to site2 as observer
----> Adding SigSci Observer All users to site site3
--------> Adding [e-mail] to site3 as observer
------------> Member [e-mail] does not exist.
------------> Inviting [e-mail] to site3 as observer
----> Adding SigSci Observer All users to site site4
--------> Adding [e-mail] to site4 as observer
------------> Member [e-mail] does not exist.
------------> Inviting [e-mail] to site4 as observer
----> Removing site1 members not in AD group SigSci Observer All
--------> Removing [e-mail]
--------> Removing [e-mail]
----> Removing blamo members not in AD group SigSci Observer All
--------> Removing [e-mail]
--------> Removing [e-mail]
--------> Removing [e-mail]
----> Removing site2 members not in AD group SigSci Observer All
--------> Removing [e-mail]
--------> Removing [e-mail]
--------> Removing [e-mail]
----> Removing site3 members not in AD group SigSci Observer All
--------> Removing [e-mail]
--------> Removing [e-mail]
----> Removing site4 members not in AD group SigSci Observer All
--------> Removing [e-mail]
--------> Removing [e-mail]
----> Syncing users in AD group SigSci User Blamo
----> Adding SigSci User Blamo users to site blamo
--------> Adding [e-mail] to blamo as user
----> Removing blamo members not in AD group SigSci User Blamo
--------> Removing [e-mail]
--------> Removing [e-mail]
--------> Removing [e-mail]