Huawei-iBMC-Cmdlets

1.3.0

scripts/LDAP.ps1

# Copyright (C) 2020 Huawei Technologies Co., Ltd. All rights reserved.
# This program is free software; you can redistribute it and/or modify
# it under the terms of the MIT License

# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# MIT License for more detail

<# NOTE: iBMC LDAP module Cmdlets #>

function Get-iBMCLDAP {
<#
.SYNOPSIS
Get all iBMC LDAP Controls infomation or specific LDAP domain information.

.DESCRIPTION
Get all iBMC LDAP Controls infomation or specific LDAP domain information.

.PARAMETER Session
iBMC redfish session object which is created by Connect-iBMC cmdlet.
A session object identifies an iBMC server to which this cmdlet will be executed.

.PARAMETER LDAPID
LDAP ID specifies the LDAP to be modified.
Optional parameter, if not specified, all domain controller information will be queried
Support integer value range: [1, 6]

.OUTPUTS
PSObject[]
Returns Array of PSObject indicates all iBMC LDAP Controls Reading infomation or specific LDAP domain information if cmdlet executes successfully.
In case of an error or warning, exception will be returned.

.EXAMPLE

PS C:\> $Credential = Get-Credential
PS C:\> $Session = Connect-iBMC -Address 10.1.1.2 -Credential $Credential -TrustCert
PS C:\> $Result = Get-iBMCLDAP -Session $Session
PS C:\> $Result | fl

Host : 10.1.1.2
Id : LdapService
Name : Ldap Service
LdapServiceEnabled : True

Id : 1
Name : Ldap Controller
LdapServerAddress : 10.1.1.10
LdapPort : 666
UserDomain : CN,DC=DD
BindDN :
BindPassword :
CertificateVerificationEnabled : False
CertificateVerificationLevel : Demand

Id : 2
Name : Ldap Controller
LdapServerAddress :
LdapPort : 636
UserDomain : ,DC=
BindDN :
BindPassword :
CertificateVerificationEnabled : False
CertificateVerificationLevel : Demand

Id : 3
Name : Ldap Controller
LdapServerAddress :
LdapPort : 636
UserDomain : ,DC=
BindDN :
BindPassword :
CertificateVerificationEnabled : False
CertificateVerificationLevel : Demand

Id : 4
Name : Ldap Controller
LdapServerAddress :
LdapPort : 636
UserDomain : ,DC=
BindDN :
BindPassword :
CertificateVerificationEnabled : False
CertificateVerificationLevel : Demand

Id : 5
Name : Ldap Controller
LdapServerAddress :
LdapPort : 636
UserDomain : ,DC=
BindDN :
BindPassword :
CertificateVerificationEnabled : False
CertificateVerificationLevel : Demand

Id : 6
Name : Ldap Controller
LdapServerAddress :
LdapPort : 636
UserDomain : ,DC=
BindDN :
BindPassword :
CertificateVerificationEnabled : False
CertificateVerificationLevel : Demand

This example shows how to query the LDAP information of multiple server

.EXAMPLE

PS C:\> $Credential = Get-Credential
PS C:\> $Session = Connect-iBMC -Address 10.1.1.2 -Credential $Credential -TrustCert
PS C:\> $LDAPID = 1
PS C:\> Get-iBMCLDAP -Session $Session -LDAPID $LDAPID

Host : 10.1.1.2
Id : 1
Name : Ldap Controller
LdapServerAddress :
LdapPort : 636
UserDomain : ,DC=
BindDN :
BindPassword :
CertificateVerificationEnabled : False
CertificateVerificationLevel :
CertificateInformation :
CertificateChainInformation :
LdapGroups : {@{MemberId=0; GroupName=; GroupDomain=CN=,OU=,DC=; GroupRole=No Access; GroupLoginRule=System.Object[];
                                 GroupLoginInterface=System.Object[]}, @{MemberId=1; GroupName=; GroupDomain=CN=,OU=,DC=; GroupRole=No Access;
                                 GroupLoginRule=System.Object[]; GroupLoginInterface=System.Object[]}, @{MemberId=2; GroupName=; GroupDomain=CN=,OU=,DC=;
                                 GroupRole=No Access; GroupLoginRule=System.Object[]; GroupLoginInterface=System.Object[]}, @{MemberId=3; GroupName=;
                                 GroupDomain=CN=,OU=,DC=; GroupRole=No Access; GroupLoginRule=System.Object[]; GroupLoginInterface=System.Object[]}...}

This example shows how to query information about the specified domain controller

.LINK
https://github.com/Huawei/Huawei-iBMC-Cmdlets

Set-iBMCLDAPServiceEnabled
Set-iBMCLDAP
Import-iBMCLDAPCert
Connect-iBMC
Disconnect-iBMC

#>
  [CmdletBinding()]
  param (
    [RedfishSession[]]
    [parameter(Mandatory = $true, ValueFromPipeline = $true, ValueFromPipelineByPropertyName = $true)]
    $Session,

    [int32[]]
    [parameter(Mandatory = $false, ValueFromPipeline = $true, ValueFromPipelineByPropertyName = $true)]
    [ValidateRange(1, 6)]
    $LDAPID
  )

  begin {
  }

  process {
    Assert-ArrayNotNull $Session 'Session'
    $LDAPIDList = Get-OptionalMatchedSizeArray $Session $LDAPID
    $Logger.info("Invoke Get All LDAP Domain Information Or Specific LDAP Domain Information function")

    $GetLDAPBlock = {
      param($Session, $LDAPID)
      $(Get-Logger).info($(Trace-Session $Session "Invoke Get All LDAP Domain Information Or Specific LDAP Domain Information function now"))

      if ($LDAPID) {
        $LDAPDetailsPath = "/AccountService/LdapService/LdapControllers/$LDAPID"
        $LDAPDetailsResponse = Invoke-RedfishRequest $Session $LDAPDetailsPath | ConvertFrom-WebResponse
        $LDAPDetailsResults = New-Object System.Collections.ArrayList
        $Properties = @("Id", "Name", "LdapServerAddress", "LdapPort", "UserDomain", "BindDN", "BindPassword",
                        "CertificateVerificationEnabled", "CertificateVerificationLevel", "CertificateInformation",
                        "CertificateChainInformation", "LdapGroups")
        $LDAPDetailsInfo = Copy-ObjectProperties $LDAPDetailsResponse $Properties
        [Void] $LDAPDetailsResults.Add($(Update-SessionAddress $Session $LDAPDetailsInfo))
        return , $LDAPDetailsResults.ToArray()
      }
      else {
        $Results = New-Object System.Collections.ArrayList

        $LDAPEnablePath = "/AccountService/LdapService/"
        $LDAPEnableResponse = Invoke-RedfishRequest $Session $LDAPEnablePath | ConvertFrom-WebResponse
        $LDAPEnableInfo = New-Object PSObject
        $LDAPEnableInfo | Add-Member -MemberType NoteProperty "Id" $LDAPEnableResponse.Id
        $LDAPEnableInfo | Add-Member -MemberType NoteProperty "Name" $LDAPEnableResponse.Name
        $LDAPEnableInfo | Add-Member -MemberType NoteProperty "LdapServiceEnabled" $LDAPEnableResponse.LdapServiceEnabled
        $LDAPEnableInfo = $(Update-SessionAddress $Session $LDAPEnableInfo)
        [Void] $Results.Add($LDAPEnableInfo)

        $Path = "/AccountService/LdapService/LdapControllers/"
        $Response = Invoke-RedfishRequest $Session $Path | ConvertFrom-WebResponse
        $LDAPControllers = $Response.Members
        $LDAPControllers | ForEach-Object {
          $LDAPResponse = Invoke-RedfishRequest $Session $_.'@odata.id' | ConvertFrom-WebResponse
          $LDAPInfo = New-Object PSObject
          $LDAPInfo | Add-Member -MemberType NoteProperty "Id" $LDAPResponse.Id
          $LDAPInfo | Add-Member -MemberType NoteProperty "Name" $LDAPResponse.Name
          $LDAPInfo | Add-Member -MemberType NoteProperty "LdapServerAddress" $LDAPResponse.LdapServerAddress
          $LDAPInfo | Add-Member -MemberType NoteProperty "LdapPort" $LDAPResponse.LdapPort
          $LDAPInfo | Add-Member -MemberType NoteProperty "UserDomain" $LDAPResponse.UserDomain
          $LDAPInfo | Add-Member -MemberType NoteProperty "BindDN" $LDAPResponse.BindDN
          $LDAPInfo | Add-Member -MemberType NoteProperty "BindPassword" $LDAPResponse.BindPassword
          $LDAPInfo | Add-Member -MemberType NoteProperty "CertificateVerificationEnabled" $LDAPResponse.CertificateVerificationEnabled
          $LDAPInfo | Add-Member -MemberType NoteProperty "CertificateVerificationLevel" $LDAPResponse.CertificateVerificationLevel
        
          [Void] $Results.Add($LDAPInfo)
        }
        return , $Results.ToArray()
      }
    }

    try {
      $tasks = New-Object System.Collections.ArrayList
      $pool = New-RunspacePool $Session.Count
      for ($idx = 0; $idx -lt $Session.Count; $idx++) {
        $RedfishSession = $Session[$idx]
        $LDAP = $LDAPIDList[$idx]
        $Parameters = @($RedfishSession, $LDAP)
        $Logger.info($(Trace-Session $RedfishSession "Submit get all LDAP information task"))
        [Void] $tasks.Add($(Start-ScriptBlockThread $pool $GetLDAPBlock $Parameters))
      }

      $Results = Get-AsyncTaskResults $tasks
      return ,$Results
    }
    finally {
      Close-Pool $pool
    }
  }

  end {
  }
}

function Set-iBMCLDAPServiceEnabled {
<#
.SYNOPSIS
Modify the enabling status of the LDAP service.

.DESCRIPTION
Modify the enabling status of the LDAP service.

.PARAMETER Session
iBMC redfish session object which is created by Connect-iBMC cmdlet.
A session object identifies an iBMC server to which this cmdlet will be executed.

.PARAMETER LdapServiceEnabled
Ldap function enable. This parameter controls the enabling status of all domain controllers.
Support values are powershell boolean value: $true(1), $false(0).

.OUTPUTS
PSObject[]
Returns the modified LDAP service object array if cmdlet executes successfully.
In case of an error or warning, exception will be returned.

.EXAMPLE

PS C:\> $Credential = Get-Credential
PS C:\> $Session = Connect-iBMC -Address 10.1.1.2 -Credential $Credential -TrustCert
PS C:\> $Result = Set-iBMCLDAPServiceEnabled -Session $Session -LdapServiceEnabled $true
PS C:\> $Result

Host : 10.1.1.2
Id : LdapService
Name : Ldap Service
LdapServiceEnabled : true

Modify LDAP service enabled properties of a server.

.LINK
https://github.com/Huawei/Huawei-iBMC-Cmdlets

Get-iBMCLDAP
Import-iBMCLDAPCert
Set-iBMCLDAP
Connect-iBMC
Disconnect-iBMC

#>
  [CmdletBinding()]
  param (
    [RedfishSession[]]
    [parameter(Mandatory = $true, ValueFromPipeline = $true, ValueFromPipelineByPropertyName = $true, Position=0)]
    $Session,

    [Boolean[]]
    [parameter(Mandatory = $true, ValueFromPipeline = $true, ValueFromPipelineByPropertyName = $true)]
    $LdapServiceEnabled
  )

  begin {
  }

  process {
    Assert-ArrayNotNull $Session 'Session'
    Assert-ArrayNotNull $LdapServiceEnabled 'LdapServiceEnabled'
    $Enableds = Get-OptionalMatchedSizeArray $Session $LdapServiceEnabled

    $SetLdapServiceEnabledBlock = {
      param($Session, $LdapServiceEnabled)
      $Payload = @{LdapServiceEnabled=$LdapServiceEnabled;}
      # Get Ldap service resources
      $LdapServicePath = '/AccountService/LdapService/'
      $LdapServiceResponse = Invoke-RedfishRequest $Session $LdapServicePath
      $Headers = @{'If-Match'=$LdapServiceResponse.Headers['Etag'];}
      $Response = Invoke-RedfishRequest $Session $LdapServicePath 'Patch' $Payload $Headers
      $SetLdapServiceEnabled = Resolve-RedfishPartialSuccessResponse $Session $Response
      $Properties = @("Id", "Name", "LdapServiceEnabled")
      $PrettyLdapService = Copy-ObjectProperties $SetLdapServiceEnabled $Properties
      return $(Update-SessionAddress $Session $PrettyLdapService)
    }

    try {
      $tasks = New-Object System.Collections.ArrayList
      $pool = New-RunspacePool $Session.Count
      for ($idx=0; $idx -lt $Session.Count; $idx++) {
        $RedfishSession = $Session[$idx]
        $Parameters = @($RedfishSession, $Enableds[$idx])
        $Logger.info($(Trace-Session $RedfishSession "Submit set LDAP service enabled task"))
        [Void] $tasks.Add($(Start-ScriptBlockThread $pool $SetLdapServiceEnabledBlock $Parameters))
      }
      return Get-AsyncTaskResults -AsyncTasks $tasks
    }
    finally {
      Close-Pool $pool
    }
  }

  end {
  }
}

function Import-iBMCLDAPCert {
<#
.SYNOPSIS
Import iBMC LDAP Certificate.

.DESCRIPTION
Import iBMC LDAP Certificate.

.PARAMETER Session
iBMC redfish session object which is created by Connect-iBMC cmdlet.
A session object identifies an iBMC server to which this cmdlet will be executed.

.PARAMETER LDAPID
LDAP ID specifies the LDAP to be modified.
Support integer value range: [1, 6]

.PARAMETER LDAPCertPath
The LDAP certificate file path

File path support:
1. import from local storage, example: c:\ca.cer or \\192.168.1.2\ca.cer
2. import from ibmc local temporary storage, example: /tmp/ca.cer
3. import from remote storage, example: protocol://username:password@hostname/directory/ca.cer
   support protocol list: sftp, https, nfs, cifs, scp


.OUTPUTS
PSObject[]
Returns the import The LDAP certificate task array if cmdlet executes successfully.
In case of an error or warning, exception will be returned.

.EXAMPLE

PS C:\> $Credential = Get-Credential
PS C:\> $Session = Connect-iBMC -Address 10.1.1.2 -Credential $Credential -TrustCert
PS C:\> $Result = Import-iBMCLDAPCert -Session $Session -LDAPID 1 -LDAPCertPath 'c:\ca.cer'
PS C:\> $Result

Host : 10.1.1.2
MessageId : iBMC.1.0.LDAPCertImportSuccess
RelatedProperties :
Message : The LDAP certificate is imported successfully.
MessageArgs :
Severity : OK
Resolution : None

This example shows how to import LDAP certificate from local file

.EXAMPLE

PS C:\> $Credential = Get-Credential
PS C:\> $Session = Connect-iBMC -Address 10.1.1.2 -Credential $Credential -TrustCert
PS C:\> $Result = Import-iBMCLDAPCert -Session $Session -LDAPID 1 -LDAPCertPath "nfs://10.1.1.100/data/ldap.cer"
PS C:\> $Result

Host : 10.1.1.2
Id : 1
Name : ldap root cert import
ActivityName : [10.1.1.2] ldap root cert import
TaskState : Completed
StartTime : 2019-11-28T16:44:46+08:00
EndTime : 2019-11-28T16:44:47+08:00
TaskStatus : OK
TaskPercent : 100%

This example shows how to import LDAP certificate from remote file

.EXAMPLE

PS C:\> $Credential = Get-Credential
PS C:\> $Session = Connect-iBMC -Address 10.1.1.2 -Credential $Credential -TrustCert
PS C:\> $LocalFilePath = 'c:\ca.cer'
PS C:\> $Upload = Invoke-iBMCFileUpload -Session $Session -FileUri $LocalFilePath
PS C:\> $Result = Import-iBMCLDAPCert -Session $session -LDAPID 1 -LDAPCertPath $Upload.Path
PS C:\> $Result

Host : 10.1.1.2
MessageId : iBMC.1.0.LDAPCertImportSuccess
RelatedProperties :
Message : The LDAP certificate is imported successfully.
MessageArgs :
Severity : OK
Resolution : None

This example shows how to upload local file to BMC and then import LDAP certificate from the upload bmc file


.EXAMPLE

PS C:\> $Credential = Get-Credential
PS C:\> $Session = Connect-iBMC -Address 10.1.1.2-3 -Credential $Credential -TrustCert
PS C:\> $LDAPID = @(1, 2)
PS C:\> $LDAPCertPath = @("c:\ldap.cer", "nfs://10.1.1.100/data/ldap.cer")
PS C:\> $Result = Import-iBMCLDAPCert -Session $Session -LDAPID $LDAPID -LDAPCertPath $LDAPCertPath
PS C:\> $Result

Host : 10.1.1.2
MessageId : iBMC.1.0.LDAPCertImportSuccess
RelatedProperties :
Message : The LDAP certificate is imported successfully.
MessageArgs :
Severity : OK
Resolution : None

Host : 10.1.1.3
Id : 2
Name : ldap root cert import
ActivityName : [10.1.1.3] ldap root cert import
TaskState : Completed
StartTime : 2019-11-29T00:38:07+08:00
EndTime : 2019-11-29T00:38:08+08:00
TaskStatus : OK
TaskPercent : 100%

This example shows how to import LDAP certificate to different servers


.LINK
https://github.com/Huawei/Huawei-iBMC-Cmdlets

Get-iBMCLDAP
Set-iBMCLDAPServiceEnabled
Set-iBMCLDAP
Connect-iBMC
Disconnect-iBMC

#>
  [CmdletBinding()]
  param (
    [RedfishSession[]]
    [parameter(Mandatory = $true, ValueFromPipeline = $true, ValueFromPipelineByPropertyName = $true, Position = 0)]
    $Session,

    [string[]]
    [parameter(Mandatory = $true, ValueFromPipeline = $true, ValueFromPipelineByPropertyName = $true, Position = 1)]
    [ValidateRange(1, 6)]
    $LDAPID,

    [string[]]
    [parameter(Mandatory = $true, ValueFromPipeline = $true, ValueFromPipelineByPropertyName = $true, Position = 2)]
    $LDAPCertPath
  )

  begin {
  }

  process {
    Assert-ArrayNotNull $Session 'Session'
    Assert-ArrayNotNull $LDAPID 'LDAPID'
    Assert-ArrayNotNull $LDAPCertPath 'LDAPCertPath'
    $LDAPIDList = Get-MatchedSizeArray $Session $LDAPID 'Session' 'LDAPID'
    $LDAPCertPathList = Get-MatchedSizeArray $Session $LDAPCertPath 'Session' 'LDAPCertPath'

    $Logger.info("Invoke Import LDAP certificates function, batch size: $($Session.Count)")

    $ImportLDAPCertBlock = {
      param($RedfishSession, $LDAPID, $CertificateFilePath)
      
      $payload = @{'Type' = "URI";}
      if ($CertificateFilePath.StartsWith("/tmp")) {
        $payload.Content = $CertificateFilePath
      } else {
        $ContentURI = Invoke-FileUploadIfNeccessary $RedfishSession $CertificateFilePath $BMC.LDAPCertSupportSchema
        $Payload.Content = $ContentURI
      }

      $Clone = $Payload.clone()
      $Clone.Content = Protect-NetworkUriUserInfo $Payload.Content
      $Logger.info($(Trace-Session $RedfishSession "Sending payload: $($Clone | ConvertTo-Json)"))
      $Path = "/redfish/v1/AccountService/LdapService/LdapControllers/$LDAPID/Actions/HwLdapController.ImportCert"
      $Response = Invoke-RedfishRequest $RedfishSession $Path 'Post' $payload | ConvertFrom-WebResponse
      if ($Response.error) {
        $LDAPLocalImportResults = $Response.error.'@Message.ExtendedInfo'
        $ImportResult = New-Object PSObject
        $ImportResult | Add-Member -MemberType NoteProperty "MessageId" $LDAPLocalImportResults.MessageId
        $ImportResult | Add-Member -MemberType NoteProperty "RelatedProperties" $LDAPLocalImportResults.RelatedProperties
        $ImportResult | Add-Member -MemberType NoteProperty "Message" $LDAPLocalImportResults.Message
        $ImportResult | Add-Member -MemberType NoteProperty "MessageArgs" $LDAPLocalImportResults.MessageArgs
        $ImportResult | Add-Member -MemberType NoteProperty "Severity" $LDAPLocalImportResults.Severity
        $ImportResult | Add-Member -MemberType NoteProperty "Resolution" $LDAPLocalImportResults.Resolution
        return $(Update-SessionAddress $RedfishSession $ImportResult)
      }
      return $Response
    }

    try {
      $Results = New-Object System.Collections.ArrayList
      $pool = New-RunspacePool $Session.Count
      $LocalTasks = New-Object System.Collections.ArrayList
      $RemoteTasks = New-Object System.Collections.ArrayList
      $RemoteSession = New-Object System.Collections.ArrayList
      for ($idx = 0; $idx -lt $Session.Count; $idx++) {
        $RedfishSession = $Session[$idx]
        $CertificateFilePath = $LDAPCertPathList[$idx]
        $_LDAPID = $LDAPIDList[$idx]
        $Logger.info($(Trace-Session $RedfishSession "Submit import LDAP certificate task"))
        $Parameters = @($RedfishSession, $_LDAPID, $CertificateFilePath)

        if ($CertificateFilePath.StartsWith("/tmp")) {
          [Void] $LocalTasks.Add($(Start-ScriptBlockThread $pool $ImportLDAPCertBlock $Parameters))
        }
        else{
          $CertFileUri = New-Object System.Uri($CertificateFilePath)
          if ($CertFileUri.Scheme -notin $BMC.LDAPCertRemoteImportSupportSchema) {
            [Void] $LocalTasks.Add($(Start-ScriptBlockThread $pool $ImportLDAPCertBlock $Parameters))
          }
          else {
            [Void] $RemoteSession.Add($RedfishSession)
            [Void] $RemoteTasks.Add($(Start-ScriptBlockThread $pool $ImportLDAPCertBlock $Parameters))
          }
        }
        
      }
      # Get local import result
      if ($LocalTasks.Count -gt 0) {
        $LocalResult = Get-AsyncTaskResults $LocalTasks
        [Void] $Results.Add($LocalResult)
      }  
      # Get remote import result
      if ($RemoteTasks.Count -gt 0) {
        $RemoteResult = Get-AsyncTaskResults $RemoteTasks
        $RemoteWaitResult = Wait-RedfishTasks $pool $RemoteSession $RemoteResult -ShowProgress
        [Void] $Results.Add($RemoteWaitResult)
      }
      
      return , $Results
    }
    finally {
      Close-Pool $pool
    }
  }

  end {
  }
}

function Set-iBMCLDAP {
<#
.SYNOPSIS
Modify an existing iBMC LDAP infomation.

.DESCRIPTION
Modify an existing iBMC LDAP infomation. Specifies an existing LDAP sequence number.

Modify the following properties of a LDAP:
- LDAP Address
- LDAP Port
- User Domain
- Bind DN
- Bind Password
- Certificate Verification Enabled
- Certificate Verification Level
- LDAP Group Name
- LDAP Group Domain
- LDAP Group Role
- LDAP Group LoginRole
- LDAP Group LoginInterface

.PARAMETER Session
iBMC redfish session object which is created by Connect-iBMC cmdlet.
A session object identifies an iBMC server to which this cmdlet will be executed.

.PARAMETER LDAPID
LDAP ID specifies the LDAP to be modified.
Support integer value range: [1, 6]

.PARAMETER LDAPAddress
LDAPAddress specifies the new LDAP address of the modified LDAP.

.PARAMETER LDAPPort
LDAPPort specifies the new LDAP port of the modified LDAP.
Support integer value range: [0, 65535]

.PARAMETER UserDomain
UserDomain specifies the new LDAP domain of the modified LDAP.
In the format of CN=A,OU=B,DC=C, the CN and DC values must be included. For example:
CN=1,DC=2.

.PARAMETER BindDN
BindDN specifies the new LDAP bindDN of the modified LDAP.
A string of 0 to 255 characters.

.PARAMETER BindPassword
BindPassword specifies the new LDAP bind password of the modified LDAP.
A string of 0 to 20 characters.

.PARAMETER CertificateVerificationEnabled
Enabled specifies Whether the certificate verification is enabled. A power shell bool($true|$false) value is accept.

.PARAMETER CertificateVerificationLevel
CertificateVerificationLevel specifies the new LDAP certificate verification level of the modified LDAP.
This parameter is used when the certificate is enabled.
Available CertificateVerificationLevel value set is:
- "Demand"
- "Allow"

.PARAMETER GroupID
Add an LDAP group ID or modify an existing group ID.
Support integer value range: [0, 4]

.PARAMETER GroupName
GroupName specifies the new LDAP group name of the modified LDAP group.
When the group_name value is null, the group configuration information is deleted.

.PARAMETER GroupDomain
GroupDomain specifies the new LDAP group group domain of the modified LDAP group.
Character string type. The format is as follows:
CN=qwert,OU=admin,DC=huawei,DC=com

.PARAMETER GroupRole
GroupRole specifies the new LDAP group role of the modified LDAP group.
Available role value set is:
- "Administrator"
- "Operator"
- "Commonuser"
- "CustomRole1"
- "CustomRole2"
- "CustomRole3"
- "CustomRole4"

.PARAMETER GroupLoginRole
GroupLoginRole specifies the new LDAP group login role of the modified LDAP group.
Available role value set is:
- "Rule1"
- "Rule2"
- "Rule3"

.PARAMETER GroupLoginInterface
GroupLoginInterface specifies the new LDAP group login interface of the modified LDAP group.
Available role value set is:
- "Web"
- "SSH"
- "Redfish"

.OUTPUTS
PSObject[]
Returns the modified LDAP object array if cmdlet executes successfully.
In case of an error or warning, exception will be returned.

.EXAMPLE

PS C:\> $Credential = Get-Credential
PS C:\> $Session = Connect-iBMC -Address 10.1.1.2 -Credential $Credential -TrustCert
PS C:\> $BindPwd = ConvertTo-SecureString -String bind-password -AsPlainText -Force
PS C:\> $GroupLoginRule = ,@("Rule1", "Rule2", "Rule3")
PS C:\> $GroupLoginInterface = ,@("Web","SSH","Redfish")
PS C:\> $result = Set-iBMCLDAP -Session $Session -LDAPID 1 -LDAPAddress "ldap.huawei.com" -LDAPPort 635 `
          -UserDomain 'CN=test,,DC=huawei,DC=com' -BindDN test -BindPassword $BindPwd `
          -CertificateVerificationEnabled $true -CertificateVerificationLevel Allow `
          -GroupID 0 -GroupName qwert -GroupDomain 'CN=qwert,OU=admin,DC=huawei,DC=com' `
          -GroupRole Administrator -GroupLoginRule $GroupLoginRule -GroupLoginInterface $GroupLoginInterface

Modify information about the specified domain controller.

.LINK
https://github.com/Huawei/Huawei-iBMC-Cmdlets

Get-iBMCLDAP
Import-iBMCLDAPCert
Import-iBMCLDAPCert
Connect-iBMC
Disconnect-iBMC

#>
  [CmdletBinding()]
  param (
    [RedfishSession[]]
    [parameter(Mandatory = $true, ValueFromPipeline = $true, ValueFromPipelineByPropertyName = $true, Position=0)]
    $Session,

    [int32[]]
    [parameter(Mandatory = $true, ValueFromPipeline = $true, ValueFromPipelineByPropertyName = $true)]
    [ValidateRange(1, 6)]
    $LDAPID,

    [string[]]
    [parameter(Mandatory = $false, ValueFromPipeline = $true, ValueFromPipelineByPropertyName = $true)]
    $LDAPAddress,

    [int32[]]
    [parameter(Mandatory = $false, ValueFromPipeline = $true, ValueFromPipelineByPropertyName = $true)]
    [ValidateRange(1, 65535)]
    $LDAPPort,

    [string[]]
    [parameter(Mandatory = $false, ValueFromPipeline = $true, ValueFromPipelineByPropertyName = $true)]
    $UserDomain,

    [string[]]
    [parameter(Mandatory = $false, ValueFromPipeline = $true, ValueFromPipelineByPropertyName = $true)]
    $BindDN,

    [System.Object[]]
    [parameter(Mandatory = $false, ValueFromPipeline = $true, ValueFromPipelineByPropertyName = $true)]
    $BindPassword,

    [Boolean[]]
    [parameter(Mandatory = $false, ValueFromPipeline = $true, ValueFromPipelineByPropertyName = $true)]
    $CertificateVerificationEnabled,

    [CertificateVerificationLevel[]]
    [parameter(Mandatory = $false, ValueFromPipeline = $true, ValueFromPipelineByPropertyName = $true)]
    $CertificateVerificationLevel,

    [int32[]]
    [parameter(Mandatory = $false, ValueFromPipeline = $true, ValueFromPipelineByPropertyName = $true)]
    [ValidateRange(0, 4)]
    $GroupID,

    [string[]]
    [parameter(Mandatory = $false, ValueFromPipeline = $true, ValueFromPipelineByPropertyName = $true)]
    $GroupName,

    [string[]]
    [parameter(Mandatory = $false, ValueFromPipeline = $true, ValueFromPipelineByPropertyName = $true)]
    $GroupDomain,

    [LDAPGroupRole[]]
    [parameter(Mandatory = $false, ValueFromPipeline = $true, ValueFromPipelineByPropertyName = $true)]
    $GroupRole,

    [GroupLoginRole[][]]
    [parameter(Mandatory = $false, ValueFromPipeline = $true, ValueFromPipelineByPropertyName = $true)]
    $GroupLoginRule,

    [GroupLoginInterface[][]]
    [parameter(Mandatory = $false, ValueFromPipeline = $true, ValueFromPipelineByPropertyName = $true)]
    $GroupLoginInterface
  )

  begin {
  }

  process {
    Assert-ArrayNotNull $Session 'Session'
    Assert-ArrayNotNull $LDAPID 'LDAPID'
    $LdapIDs = Get-MatchedSizeArray $Session $LDAPID 'Session' 'LDAPID'
    $LDAPAddresses = Get-OptionalMatchedSizeArray $Session $LDAPAddress
    $LDAPPorts = Get-OptionalMatchedSizeArray $Session $LDAPPort
    $UserDomains = Get-OptionalMatchedSizeArray $Session $UserDomain
    $BindDNs = Get-OptionalMatchedSizeArray $Session $BindDN
    $BindPasswords = Get-OptionalMatchedSizeArray $Session $BindPassword
    $CertificateVerificationEnableds = Get-OptionalMatchedSizeArray $Session $CertificateVerificationEnabled
    $CertificateVerificationLevels = Get-OptionalMatchedSizeArray $Session $CertificateVerificationLevel
    $GroupIDs = Get-OptionalMatchedSizeArray $Session $GroupID
    $GroupNames = Get-OptionalMatchedSizeArray $Session $GroupName
    $GroupDomains = Get-OptionalMatchedSizeArray $Session $GroupDomain
    $GroupRoles = Get-OptionalMatchedSizeArray $Session $GroupRole
    $ValidGroupLoginroles = Get-EnumNames "GroupLoginRole"
    $GroupLoginRules = Get-OptionalMatchedSizeMatrix $Session $GroupLoginRule $ValidGroupLoginroles 'Session' 'GroupLoginRule'
    $ValidGroupLoginInterfaces = Get-EnumNames "GroupLoginInterface"
    $GroupLoginInterfaces = Get-OptionalMatchedSizeMatrix $Session $GroupLoginInterface $ValidGroupLoginInterfaces 'Session' 'GroupLoginInterface'

    $SetLDAPBlock = {
      param($RedfishSession, $ldapID, $Payload)
      
      $LDAPInfoPath = "/AccountService/LdapService/LdapControllers/$ldapID"   
      $Logger.info($(Trace-Session $RedfishSession "LDAP $ldapID found, will patch ldap now"))

      $Clone = $Payload.clone()
      if ($null -ne $Payload.BindPassword) {
            $PlainPasswd = ConvertTo-PlainString $Payload.BindPassword "BindPassword"
            $Payload.BindPassword = $PlainPasswd
            $Clone.BindPassword = "******"
      }

      $Logger.info($(Trace-Session $RedfishSession "Sending payload: $($Clone | ConvertTo-Json -Depth 5)"))
      $Response = Invoke-RedfishRequest $RedfishSession $LDAPInfoPath 'Patch' $Payload
      Resolve-RedfishPartialSuccessResponse $RedfishSession $Response | Out-Null
      return $null
    }

    try {
      $tasks = New-Object System.Collections.ArrayList
      $pool = New-RunspacePool $Session.Count
      for ($idx=0; $idx -lt $Session.Count; $idx++) {     
        $RedfishSession = $Session[$idx]
        $_LDAPID = $LdapIDs[$idx]
        $Payload = @{
          "LdapServerAddress" = $LDAPAddresses[$idx];
          "LdapPort" = $LDAPPorts[$idx];
          "UserDomain" = $UserDomains[$idx];
          "BindDN" = $BindDNs[$idx];
          "BindPassword" = $BindPasswords[$idx];
          "CertificateVerificationEnabled" = $CertificateVerificationEnableds[$idx];
          "CertificateVerificationLevel" = $CertificateVerificationLevels[$idx]
        } | Resolve-EnumValues

        $GroupInfo = @{
          "GroupName" = $GroupNames[$idx];
          "GroupDomain" = $GroupDomains[$idx];
          "GroupRole" = $GroupRoles[$idx];
          "GroupLoginRule" = $GroupLoginRules[$idx];
          "GroupLoginInterface" = $GroupLoginInterfaces[$idx]
        } | Remove-EmptyValues | Resolve-EnumValues
                
        $LDAPGroupID = $GroupIDs[$idx]
        $GroupList = New-Object System.Collections.ArrayList
        $flag = $false
        for ($i = 0; $i -lt 5; $i++) {
          if ($LDAPGroupID -eq $i) {
            [Void] $GroupList.Add($GroupInfo)
            if ($GroupInfo.Count -ne 0) {
              $flag = $true
            }
            else {
              # Group ID exists, but group info is null
              throw $(Get-i18n ERROR_LDAP_GROUPINFO_INVALID)
            }
          } else {
            [Void] $GroupList.Add(@{})
          }
        }

        # Group info exists, but group ID is null
        if ((-not $flag) -and ($GroupInfo.Count -ne 0)) {
          throw $(Get-i18n ERROR_LDAP_GROUPID_INVALID)
        }

        if ($flag) {
          # When group name is null, delete this group info
          if ($GroupList[$LDAPGroupID].GroupName -eq 'null') {
            $GroupList[$LDAPGroupID].GroupName = $null
          }

          # Covert group role
          if ($GroupList[$LDAPGroupID].GroupRole) {
            if ($GroupList[$LDAPGroupID].GroupRole -eq "Commonuser") {
              $GroupList[$LDAPGroupID].GroupRole = "Common User"
            }
            if ($GroupList[$LDAPGroupID].GroupRole -eq "CustomRole1") {
              $GroupList[$LDAPGroupID].GroupRole = "Custom Role 1"
            }
            if ($GroupList[$LDAPGroupID].GroupRole -eq "CustomRole2") {
              $GroupList[$LDAPGroupID].GroupRole = "Custom Role 2"
            }
            if ($GroupList[$LDAPGroupID].GroupRole -eq "CustomRole3") {
              $GroupList[$LDAPGroupID].GroupRole = "Custom Role 3"
            }
            if ($GroupList[$LDAPGroupID].GroupRole -eq "CustomRole4") {
              $GroupList[$LDAPGroupID].GroupRole = "Custom Role 4"
            }
          }

          $Payload.LdapGroups = $GroupList
        }
                
        $Payload_ = Remove-EmptyValues $Payload
        if ($Payload_.Count -eq 0) {
          throw $(Get-i18n FAIL_NO_UPDATE_PARAMETER)
        }

        $Parameters = @($RedfishSession, $_LDAPID, $Payload_)
        $Logger.info($(Trace-Session $RedfishSession "Submit set LDAP information task"))
        [Void] $tasks.Add($(Start-ScriptBlockThread $pool $SetLDAPBlock $Parameters)) 
      }

      $Results = Get-AsyncTaskResults $tasks
      return ,$Results
    }
    finally {
      Close-Pool $pool
    }
  }

  end {
  }
}