u.trust LAN Crypt Admin API · English
Example Script
HerstellerquelleImportierter Dokumentationsstand – bitte Produktversion beachten.
Example Script (VB Script)
'********************** SGLC TestScript ***********
'*** ***
'*** requires an existing DB with an MSO ***
'*** "Master Security Officer" ***
'*** none of the objects created in the script ***
'*** must exist (TestSO, user, groups) ***
'*** ***
'**************************************************
dim SGLCAPIERR_OK : SGLCAPIERR_OK = 0
dim LCAPIERR_INSUFFICIENT_RIGHTS : LCAPIERR_INSUFFICIENT_RIGHTS = 32
dim LCAPIERR_INVALID_ARGUMENT : LCAPIERR_INVALID_ARGUMENT = 14
dim lcapi
dim res
'*** Create LCScript API Object ***
set lcapi = WScript.CreateObject("SGLCScriptApi.SGLCApi")
'*** Init DB Connection and logon SO ***
res = lcapi.LogonToDatabase("SGLCSQLServer", "", "", 0, "")
if res <> SGLCAPIERR_OK then
err.raise res, "LogonToDatabase", lcapi.GetErrorDesc(res), , 0
end if
res = lcapi.LogonSO("Master Security Officer")
if res <> SGLCAPIERR_OK then
err.raise res, "LogonSO", lcapi.GetErrorDesc(res), , 0
end if
'************** write some groups and users
res = lcapi.CreateGroupEx("group", "group", "group", "", "", 528, "")
if res <> SGLCAPIERR_OK then
err.raise res, "CreateGroup", lcapi.GetErrorDesc(res), , 0
end if
res = lcapi.CreateGroupEx("group1", "group1", "group1", "", "group", 516, "")
if res <> SGLCAPIERR_OK then
err.raise res, "AddSubGroup", lcapi.GetErrorDesc(res), , 0
end if
res = lcapi.CreateGroup("group2", "", "")
if res <> SGLCAPIERR_OK then
err.raise res, "CreateGroup", lcapi.GetErrorDesc(res), , 0
end if
res = lcapi.CreateGroup("group3", "group2", "")
if res <> SGLCAPIERR_OK then
err.raise res, "CreateGroup", lcapi.GetErrorDesc(res), , 0
end if
res = lcapi.CreateUser("markus", "markus@utimaco.de", "markus", "Markus", "")
if res <> SGLCAPIERR_OK then
err.raise res, "CreateUser", lcapi.GetErrorDesc(res), , 0
end if
res = lcapi.AdduserToGroup("markus", "group", "comment", 0)
if res <> SGLCAPIERR_OK then
err.raise res, "AddUserToGroup", lcapi.GetErrorDesc(res), , 0
end if
res = lcapi.CreateUser("gustav", "gustav@utimaco.de", "gustav", "gustav", "")
if res <> SGLCAPIERR_OK then
err.raise res, "CreateUser", lcapi.GetErrorDesc(res), , 0
end if
res = lcapi.AdduserToGroup("gustav", "group1", "comment", 0)
if res <> SGLCAPIERR_OK then
err.raise res, "AddUserToGroup", lcapi.GetErrorDesc(res), , 0
end if
res = lcapi.CreateUser("christian", "christian@utimaco.de", "christian", "just Christian", "")
if res <> SGLCAPIERR_OK then
err.raise res, "CreateUser", lcapi.GetErrorDesc(res), , 0
end if
res = lcapi.AdduserToGroup("christian", "group2", "comment", 0)
if res <> SGLCAPIERR_OK then
err.raise res, "AddUserToGroup", lcapi.GetErrorDesc(res), , 0
end if
res = lcapi.CreateUser("norbert", "norbert@utimaco.de", "norbert", "just Norbert", "")
if res <> SGLCAPIERR_OK then
err.raise res, "CreateUser", lcapi.GetErrorDesc(res), , 0
end if
res = lcapi.AdduserToGroup("norbert", "group1", "comment", 0)
if res <> SGLCAPIERR_OK then
err.raise res, "AddUserToGroup", lcapi.GetErrorDesc(res), , 0
end if
res = lcapi.CreateCertificatesForUsersOfGroup("group", 1)
if res <> SGLCAPIERR_OK then
err.raise res, "CreateCertificatesForUsersOfGroup", lcapi.GetErrorDesc(res), , 0
end if
res = lcapi.CreateCertificatesForUsersOfGroup("group2", 1)
if res <> SGLCAPIERR_OK then
err.raise res, "CreateCertificatesForUsersOfGroup", lcapi.GetErrorDesc(res), , 0
end if
'************** generate certificates
res = lcapi.CreateCertificatesForUsersOfGroup("group", FALSE)
if res <> SGLCAPIERR_OK then
err.raise res, "CreateCertificatesForUsersOfGroup 1", lcapi.GetErrorDesc(res), , 0
end if
res = lcapi.CreateCertificatesForUsersOfGroup("group1", FALSE)
if res <> SGLCAPIERR_OK then
err.raise res, "CreateCertificatesForUsersOfGroup 2", lcapi.GetErrorDesc(res), , 0
end if
res = lcapi.CreateCertificatesForUsersOfGroup("group2", TRUE)
if res <> SGLCAPIERR_OK then
err.raise res, "CreateCertificatesForUsersOfGroup 3", lcapi.GetErrorDesc(res), , 0
end if
'************** display certificates
dim certs
set certs = CreateObject("CAPICOM.Certificates")
certs.Clear
res = lcapi.EnumCertificatesOfUser("markus", certs)
if (res <> SGLCAPIERR_OK) AND (res <> LCAPIERR_INVALID_ARGUMENT) then
err.raise res, "EnumCertificatesOfUser", lcapi.GetErrorDesc(res), , 0
end if
dim thecert
WScript.Echo certs.Count & " certs found"
for i = 1 to certs.Count
set thecert = certs.Item(i)
WScript.Echo thecert.SubjectName
next
'************** create SO and assign some rights
const ACL_GR_CREATEKEY = &H00000001&
const ACL_GR_COPYKEY = &H00000002&
const ACL_GR_DELETEKEY = &H00000004&
const ACL_GR_CREATERULES = &H00000008&
const ACL_GR_ASSIGNCERT = &H00000010&
const ACL_GR_ADDUSER = &H00000020&
const ACL_GR_DELETEUSER = &H00000040&
const ACL_GR_ADDGROUP = &H00000080&
const ACL_GR_DELSUBGROUP = &H00000100&
const ACL_GR_MOVEGROUP = &H00000200&
const ACL_GR_CHANGEGROUPPROP = &H00000400&
const ACL_GR_DELGROUP = &H00000800&
const ACL_GR_CREATEPROFILE = &H00001000&
const ACL_GR_CHANGEACL = &H00002000&
const ACL_GR_READ = &H00004000&
const ACL_GR_VISIBLE = &H00008000&
const ACL_SOR_CHANGENAME = &H01000000&
const ACL_SOR_CHANGECERT = &H02000000&
const ACL_SOR_CHANGEREG = &H04000000&
const ACL_SOR_ASSIGNCONF = &H08000000&
const ACL_SOR_DELSO = &H10000000&
const ACL_SOR_CHANGEPERM = &H20000000&
const ACL_SOR_CHANGEACL = &H40000000&
const ACL_SOR_READ = &H80000000&
const SO_R_LOGINDB = &H00000400&
const SO_R_CREATEKEY = &H00000004&
'defines to set all rights
const ACL_SOR_ALL = &HFF000000&
const ACL_GR_ALL = &H00FFFFFF&
res = lcapi.CreateCertificate("TestSO", thecert)
if (res <> SGLCAPIERR_OK) AND (res <> LCAPIERR_INVALID_ARGUMENT) then
err.raise res, "CreateCertificate", lcapi.GetErrorDesc(res), , 0
end if
res = lcapi.AddSO("TestSO", thecert, thecert, "TestSO@utimaco.de", "", 0, SO_R_LOGINDB)
if (res <> SGLCAPIERR_OK) AND (res <> LCAPIERR_INVALID_ARGUMENT) then
err.raise res, "AddSO", lcapi.GetErrorDesc(res), , 0
end if
'********** SO does not have SO_R_CREATEKEY permission, so it is not possible to grant ACL_GR_CREATEKEY.
res = lcapi.GrantRightsOnGroupToSO("group", "TestSO", ACL_GR_VISIBLE OR ACL_GR_READ OR ACL_GR_CREATEKEY, 0)
if res <> LCAPIERR_INSUFFICIENT_RIGHTS then
err.raise res, "GrantRightsOnGroupToSO", lcapi.GetErrorDesc(res), , 0
else
WScript.Echo lcapi.GetErrorDesc(res)
end if
res = lcapi.SetSOPermissions("TestSO", SO_R_LOGINDB OR SO_R_CREATEKEY)
if res <> SGLCAPIERR_OK then
err.raise res, "SetSOPermissions", lcapi.GetErrorDesc(res), , 0
end if
'*****retry
res = lcapi.GrantRightsOnGroupToSO("group", "TestSO", ACL_GR_VISIBLE OR ACL_GR_READ OR ACL_GR_CREATEKEY, 0)
if res <> SGLCAPIERR_OK then
err.raise res, "GrantRightsOnGroupToSO", lcapi.GetErrorDesc(res), , 0
end if
'************** write some keys and rules
dim a
res = lcapi.WriteKey("group", "group", 15, 0, 0, "0x12345678", "comment", a)
if res <> SGLCAPIERR_OK then
err.raise res, "WriteKey", lcapi.GetErrorDesc(res), , 0
end if
res = lcapi.WriteKey("group1", "group1", 15, 0, 0, "0xdeadbeef", "comment", a)
if res <> SGLCAPIERR_OK then
err.raise res, "WriteKey", lcapi.GetErrorDesc(res), , 0
end if
res = lcapi.WriteKey("group2", "group2", 15, 2, 0, "0xabcdefabcdef", "comment", a)
if res <> SGLCAPIERR_OK then
err.raise res, "WriteKey", lcapi.GetErrorDesc(res), , 0
end if
res = lcapi.WriteKey("group3", "group3", 15, 3, 0, "0x87654321", "comment", a)
if res <> SGLCAPIERR_OK then
err.raise res, "WriteKey", lcapi.GetErrorDesc(res), , 0
end if
res = lcapi.WriteRule("group1", "c:\lctest\*.*", "group1", "")
if res <> SGLCAPIERR_OK then
err.raise res, "WriteRule 1", lcapi.GetErrorDesc(res), , 0
end if
res = lcapi.WriteRule("group", "c:\test\*.*", "<GROUPKEY>", "/S")
if res <> SGLCAPIERR_OK then
err.raise res, "WriteRule 2", lcapi.GetErrorDesc(res), , 0
end if
res = lcapi.WriteRule("group", "c:\user\*.*", "<USERKEY>", "/S")
if res <> SGLCAPIERR_OK then
err.raise res, "WriteRule 2", lcapi.GetErrorDesc(res), , 0
end if
res = lcapi.WriteRule("group2", "c:\error\*.*", "", "/X")
if res <> SGLCAPIERR_OK then
err.raise res, "WriteRule 3", lcapi.GetErrorDesc(res), , 0
end if
res = lcapi.WriteRule("group3", "c:\ignore\*.*", "", "/I")
if res <> SGLCAPIERR_OK then
err.raise res, "WriteRule 4", lcapi.GetErrorDesc(res), , 0
end if
'************** generate profiles
'res = lcapi.StartResolverForUser("markus", "c:\polfiles\")
'if res <> SGLCAPIERR_OK then
' err.raise res, "StartResolverForUser", lcapi.GetErrorDesc(res), , 0
'end if
res = lcapi.StartResolverForUsersOfGroup("group", "c:\polfiles\", 1)
if res <> SGLCAPIERR_OK then
err.raise res, "StartResolverForUsersOfGroup 1", lcapi.GetErrorDesc(res), , 0
end if
res = lcapi.StartResolverForUsersOfGroup("group2", "c:\polfiles", 1)
if res <> SGLCAPIERR_OK then
err.raise res, "StartResolverForUsersOfGroup 3", lcapi.GetErrorDesc(res), , 0
end if
'************** dump all keys
dim keynames()
dim keys: keys = 0
dim size: size = keys
res = lcapi.EnumKeys("<ALL>", size, keynames, 0)
if (res <> SGLCAPIERR_OK) AND (res <> LCAPIERR_INVALID_ARGUMENT) then
err.raise res, "EnumKeys", lcapi.GetErrorDesc(res), , 0
end if
if (size > keys) then
redim preserve keynames(size)
res = lcapi.EnumKeys("<ALL>", size, keynames, 0)
end if
dim parentname
dim algo
dim inherit
dim specific
dim enabled
dim value
dim comment
dim longname
dim name
dim str
str = "Page #1" & vbCr & vbCr
for i = 1 to size
res = lcapi.ReadKey(keynames(i-1), parentname, algo, inherit, specific, value, comment, longname, enabled)
if (res <> SGLCAPIERR_OK) AND (res <> LCAPIERR_INVALID_ARGUMENT) then
err.raise res, "ReadKey", lcapi.GetErrorDesc(res), , 0
end if
str = str & keynames(i-1) & "::" & value & vbCr & vbCr
if ((i mod 8) = 7) then
WScript.Echo str
str = "Page #" & Round((i / 8) + 1) & vbCr & vbCr
end if
next
WScript.Echo str & vbCr
'************
res = lcapi.LogoffSO()
if res <> SGLCAPIERR_OK then
err.raise res, "LogoffSO", lcapi.GetErrorDesc(res), , 0
end if
res = lcapi.LogoffFromDatabase
if res <> SGLCAPIERR_OK then
err.raise res, "LogoffFromDatabase", lcapi.GetErrorDesc(res), , 0
end if
WScript.Echo "Done"
set lcapi = nothing