Running a powershell script using a batch file (.bat)

Question

Scenario:

I'm developing a custom PAP for WSO2 IS 5.0.0. I have simple rules to administrate such as:

The user Bob can read Orders of branch XYZ?

The user Bob can create Invoices of branch PTO?

I'm thinking to write one Policy per user with many rules, each rule containing the resource and action as target and testing branch and user in conditions.

Here is an example:

<Policy xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17" PolicyId="UserPolicy" RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable" Version="1.0">
   <Target></Target>
   <Rule Effect="Permit" RuleId="Rule-User-1">
      <Target>
         <AnyOf>
            <AllOf>
               <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-regexp-match">
                  <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">/api/Orders/*</AttributeValue>
                  <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"></AttributeDesignator>
               </Match>
               <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
                  <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">GET</AttributeValue>
                  <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"></AttributeDesignator>
               </Match>
            </AllOf>
         </AnyOf>
      </Target>
      <Condition>
         <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:and">
            <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:any-of">
               <Function FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal"></Function>
               <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">[email protected]</AttributeValue>
               <AttributeDesignator AttributeId="http://wso2.org/claims/emailaddress" Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"></AttributeDesignator>
            </Apply>
            <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:or">
               <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:any-of">
                  <Function FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal"></Function>
                  <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">XYZ</AttributeValue>
                  <AttributeDesignator AttributeId="branch" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:environment" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"></AttributeDesignator>
               </Apply>
               <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:any-of">
                  <Function FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal"></Function>
                  <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">PTO</AttributeValue>
                  <AttributeDesignator AttributeId="branch" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:environment" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"></AttributeDesignator>
               </Apply>            
            </Apply>
         </Apply>
      </Condition>
   </Rule>
   <Rule Effect="Permit" RuleId="Rule-User-2">
            <Target>
         <AnyOf>
            <AllOf>
               <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-regexp-match">
                  <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">/api/Orders/*</AttributeValue>
                  <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"></AttributeDesignator>
               </Match>
               <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
                  <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">POST</AttributeValue>
                  <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"></AttributeDesignator>
               </Match>
            </AllOf>
         </AnyOf>
      </Target>
      <Condition>
         <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:and">
            <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:any-of">
               <Function FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal"></Function>
               <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">[email protected]</AttributeValue>
               <AttributeDesignator AttributeId="http://wso2.org/claims/emailaddress" Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"></AttributeDesignator>
            </Apply>
            <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:or">
               <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:any-of">
                  <Function FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal"></Function>
                  <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">PTO</AttributeValue>
                  <AttributeDesignator AttributeId="branch" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:environment" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"></AttributeDesignator>
               </Apply>            
            </Apply>
         </Apply>
      </Condition>
   </Rule>
   <Rule Effect="Deny" RuleId="DenyRule-User"></Rule>
</Policy>        

Problem:

As we see above, for one permission question I have too many lines. I'm working with an ERP system and it can have many resources (APIs) and an user can have many branches in it context to access. I think with this approach of one file per user I'll have big files and I don't know if it could cause bad performance to PDP and to my ERP as well.

Question:

Someone see here a better approach?

Solution 1

What you would want to do is to replace the end of command where it calls out to Initialize-PowerCLIEnvironment.ps1 and replace that with the path to your sample.ps1 file.

You will almost certainly need to have the first line of your sample file be the original reference to Initialize-PowerCLIEnvironment.ps1 such that the initialization code (most likely function/cmdlet definitions) is run prior to any of your code that may depend on it.

For example, the contents of your sample.ps1 file would look something like this:

# source vSphere PowerCLI Environment first
. "C:\Program Files\VMware\Infrastructure\vSphere PowerCLI\Scripts\Initialize-PowerCLIEnvironment.ps1"
# custom code follows
$me = "Hello, vSphere and PowerCLI!!!"

Solution 2

echo off

Title,Sample Script &color 9e

for /f "usebackq delims=$" %%a in (`cd`) do (
  set SCRIPTDIR=%%a
)

(Set ScriptFile=%SCRIPTDIR%\Sample.ps1)

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -psc "C:\Program Files\VMware\Infrastructure\vSphere PowerCLI\vim.psc1" -c ". \"C:\Program Files\VMware\Infrastructure\vSphere PowerCLI\Scripts\Initialize-PowerCLIEnvironment.ps1\";%ScriptFile%"

Comments

[DavidPostill]

While this may answer the question, it would be a better answer if you could provide some explanation why it does so.