Feature #49: Active Directory Managed Groups

Document Template Attachments, Device Batches, Device Profiles and User Flags can be associated with an Active Directory group. This AD group is then automatically synchronized with relevant User/Machine accounts. Contains various other UI tweaks and configuration enhancements.
2014-06-16 22:21:31 +10:00
parent ebf78dd08d
commit a819d2722a
119 changed files with 8349 additions and 2373 deletions
@@ -1,6 +1,9 @@
 using Disco.BI.Extensions;
 using Disco.Models.Repository;
 using Disco.Services.Authorization;
+using Disco.Services.Devices.ManagedGroups;
+using Disco.Services.Interop.ActiveDirectory;
+using Disco.Services.Tasks;
 using Disco.Services.Web;
 using Disco.Web.Extensions;
 using System;
@@ -27,6 +30,8 @@ namespace Disco.Web.Areas.API.Controllers
        const string pInsuredUntil = "insureduntil";
        const string pInsuranceDetails = "insurancedetails";
        const string pComments = "comments";
+        const string pDevicesLinkedGroup = "deviceslinkedgroup";
+        const string pAssignedUsersLinkedGroup = "assigneduserslinkedgroup";

        [DiscoAuthorize(Claims.Config.DeviceBatch.Configure)]
        public virtual ActionResult Update(int id, string key, string value = null, bool redirect = false)
@@ -86,6 +91,12 @@ namespace Disco.Web.Areas.API.Controllers
                        case pComments:
                            UpdateComments(deviceBatch, value);
                            break;
+                        case pDevicesLinkedGroup:
+                            UpdateDevicesLinkedGroup(deviceBatch, value);
+                            break;
+                        case pAssignedUsersLinkedGroup:
+                            UpdateAssignedUsersLinkedGroup(deviceBatch, value);
+                            break;
                        default:
                            throw new Exception("Invalid Update Key");
                    }
@@ -193,6 +204,71 @@ namespace Disco.Web.Areas.API.Controllers
        {
            return Update(id, pComments, Comments, redirect);
        }
+
+        [DiscoAuthorize(Claims.Config.DeviceBatch.Configure)]
+        public virtual ActionResult UpdateDevicesLinkedGroup(int id, string GroupId = null, bool redirect = false)
+        {
+            try
+            {
+                if (id < 0)
+                    throw new ArgumentOutOfRangeException("id");
+
+                var deviceBatch = Database.DeviceBatches.Find(id);
+                if (deviceBatch == null)
+                    throw new ArgumentException("Invalid Device Batch Id", "id");
+
+                var syncTaskStatus = UpdateDevicesLinkedGroup(deviceBatch, GroupId);
+                if (redirect)
+                    if (syncTaskStatus == null)
+                        return RedirectToAction(MVC.Config.DeviceBatch.Index(deviceBatch.Id));
+                    else
+                    {
+                        syncTaskStatus.SetFinishedUrl(Url.Action(MVC.Config.DeviceBatch.Index(deviceBatch.Id)));
+                        return RedirectToAction(MVC.Config.Logging.TaskStatus(syncTaskStatus.SessionId));
+                    }
+                else
+                    return Json("OK", JsonRequestBehavior.AllowGet);
+            }
+            catch (Exception ex)
+            {
+                if (redirect)
+                    throw;
+                else
+                    return Json(string.Format("Error: {0}", ex.Message), JsonRequestBehavior.AllowGet);
+            }
+        }
+        [DiscoAuthorize(Claims.Config.DeviceBatch.Configure)]
+        public virtual ActionResult UpdateAssignedUsersLinkedGroup(int id, string GroupId = null, bool redirect = false)
+        {
+            try
+            {
+                if (id < 0)
+                    throw new ArgumentOutOfRangeException("id");
+
+                var deviceBatch = Database.DeviceBatches.Find(id);
+                if (deviceBatch == null)
+                    throw new ArgumentException("Invalid Device Batch Id", "id");
+
+                var syncTaskStatus = UpdateAssignedUsersLinkedGroup(deviceBatch, GroupId);
+                if (redirect)
+                    if (syncTaskStatus == null)
+                        return RedirectToAction(MVC.Config.DeviceBatch.Index(deviceBatch.Id));
+                    else
+                    {
+                        syncTaskStatus.SetFinishedUrl(Url.Action(MVC.Config.DeviceBatch.Index(deviceBatch.Id)));
+                        return RedirectToAction(MVC.Config.Logging.TaskStatus(syncTaskStatus.SessionId));
+                    }
+                else
+                    return Json("OK", JsonRequestBehavior.AllowGet);
+            }
+            catch (Exception ex)
+            {
+                if (redirect)
+                    throw;
+                else
+                    return Json(string.Format("Error: {0}", ex.Message), JsonRequestBehavior.AllowGet);
+            }
+        }
        #endregion

        #region Update Properties
@@ -397,6 +473,40 @@ namespace Disco.Web.Areas.API.Controllers
                deviceBatch.Comments = Comments;
            Database.SaveChanges();
        }
+
+        private ScheduledTaskStatus UpdateDevicesLinkedGroup(DeviceBatch DeviceBatch, string DevicesLinkedGroup)
+        {
+            var configJson = ADManagedGroup.ValidConfigurationToJson(DeviceBatchDevicesManagedGroup.GetKey(DeviceBatch), DevicesLinkedGroup, null);
+
+            if (DeviceBatch.DevicesLinkedGroup != configJson)
+            {
+                DeviceBatch.DevicesLinkedGroup = configJson;
+                Database.SaveChanges();
+
+                var managedGroup = DeviceBatchDevicesManagedGroup.Initialize(DeviceBatch);
+                if (managedGroup != null) // Sync Group
+                    return ADManagedGroupsSyncTask.ScheduleSync(managedGroup);
+            }
+
+            return null;
+        }
+
+        private ScheduledTaskStatus UpdateAssignedUsersLinkedGroup(DeviceBatch DeviceBatch, string AssignedUsersLinkedGroup)
+        {
+            var configJson = ADManagedGroup.ValidConfigurationToJson(DeviceBatchAssignedUsersManagedGroup.GetKey(DeviceBatch), AssignedUsersLinkedGroup, null);
+
+            if (DeviceBatch.AssignedUsersLinkedGroup != configJson)
+            {
+                DeviceBatch.AssignedUsersLinkedGroup = configJson;
+                Database.SaveChanges();
+
+                var managedGroup = DeviceBatchDevicesManagedGroup.Initialize(DeviceBatch);
+                if (managedGroup != null) // Sync Group
+                    return ADManagedGroupsSyncTask.ScheduleSync(managedGroup);
+            }
+
+            return null;
+        }
        #endregion

        #region Actions
@@ -131,15 +131,10 @@ namespace Disco.Web.Areas.API.Controllers
        }

        [DiscoAuthorize(Claims.Device.Actions.AssignUser)]
-        public virtual ActionResult UpdateAssignedUserId(string id, string AssignedUserId = null, string AssignedUserDomain = null, bool redirect = false)
+        public virtual ActionResult UpdateAssignedUserId(string id, string AssignedUserId = null, bool redirect = false)
        {
-            if (AssignedUserId != null && !AssignedUserId.Contains('\\'))
-            {
-                if (string.IsNullOrWhiteSpace(AssignedUserDomain))
-                    AssignedUserId = string.Format(@"{0}\{1}", ActiveDirectory.Context.PrimaryDomain.NetBiosName, AssignedUserId);
-                else
-                    AssignedUserId = string.Format(@"{0}\{1}", AssignedUserDomain, AssignedUserId);
-            }
+            if (!string.IsNullOrWhiteSpace(AssignedUserId))
+                AssignedUserId = ActiveDirectory.ParseDomainAccountId(AssignedUserId);

            return Update(id, pAssignedUserId, AssignedUserId, redirect);
        }
@@ -1,17 +1,17 @@
 using Disco.BI.Extensions;
 using Disco.Models.Repository;
 using Disco.Services.Authorization;
+using Disco.Services.Devices.ManagedGroups;
 using Disco.Services.Interop.ActiveDirectory;
+using Disco.Services.Tasks;
 using Disco.Services.Web;
 using System;
-using System.Linq;
 using System.Web.Mvc;

 namespace Disco.Web.Areas.API.Controllers
 {
    public partial class DeviceProfileController : AuthorizedDatabaseController
    {
-
        const string pDescription = "description";
        const string pName = "name";
        const string pShortName = "shortname";
@@ -25,6 +25,8 @@ namespace Disco.Web.Areas.API.Controllers
        const string pProvisionADAccount = "provisionadaccount";
        const string pAssignedUserLocalAdmin = "assigneduserlocaladmin";
        const string pAllowUntrustedReimageJobEnrolment = "allowuntrustedreimagejobrnrolment";
+        const string pDevicesLinkedGroup = "deviceslinkedgroup";
+        const string pAssignedUsersLinkedGroup = "assigneduserslinkedgroup";

        [DiscoAuthorize(Claims.Config.DeviceProfile.Configure)]
        public virtual ActionResult Update(int id, string key, string value = null, Nullable<bool> redirect = null)
@@ -82,6 +84,12 @@ namespace Disco.Web.Areas.API.Controllers
                        case pAllowUntrustedReimageJobEnrolment:
                            UpdateAllowUntrustedReimageJobEnrolment(deviceProfile, value);
                            break;
+                        case pDevicesLinkedGroup:
+                            UpdateDevicesLinkedGroup(deviceProfile, value);
+                            break;
+                        case pAssignedUsersLinkedGroup:
+                            UpdateAssignedUsersLinkedGroup(deviceProfile, value);
+                            break;
                        default:
                            throw new Exception("Invalid Update Key");
                    }
@@ -183,6 +191,71 @@ namespace Disco.Web.Areas.API.Controllers
        {
            return Update(id, pAllowUntrustedReimageJobEnrolment, AllowUntrustedReimageJobEnrolment, redirect);
        }
+
+        [DiscoAuthorize(Claims.Config.DeviceProfile.Configure)]
+        public virtual ActionResult UpdateDevicesLinkedGroup(int id, string GroupId = null, bool redirect = false)
+        {
+            try
+            {
+                if (id < 0)
+                    throw new ArgumentOutOfRangeException("id");
+
+                var deviceProfile = Database.DeviceProfiles.Find(id);
+                if (deviceProfile == null)
+                    throw new ArgumentException("Invalid Device Profile Id", "id");
+
+                var syncTaskStatus = UpdateDevicesLinkedGroup(deviceProfile, GroupId);
+                if (redirect)
+                    if (syncTaskStatus == null)
+                        return RedirectToAction(MVC.Config.DeviceProfile.Index(deviceProfile.Id));
+                    else
+                    {
+                        syncTaskStatus.SetFinishedUrl(Url.Action(MVC.Config.DeviceProfile.Index(deviceProfile.Id)));
+                        return RedirectToAction(MVC.Config.Logging.TaskStatus(syncTaskStatus.SessionId));
+                    }
+                else
+                    return Json("OK", JsonRequestBehavior.AllowGet);
+            }
+            catch (Exception ex)
+            {
+                if (redirect)
+                    throw;
+                else
+                    return Json(string.Format("Error: {0}", ex.Message), JsonRequestBehavior.AllowGet);
+            }
+        }
+        [DiscoAuthorize(Claims.Config.DeviceProfile.Configure)]
+        public virtual ActionResult UpdateAssignedUsersLinkedGroup(int id, string GroupId = null, bool redirect = false)
+        {
+            try
+            {
+                if (id < 0)
+                    throw new ArgumentOutOfRangeException("id");
+
+                var deviceProfile = Database.DeviceProfiles.Find(id);
+                if (deviceProfile == null)
+                    throw new ArgumentException("Invalid Device Profile Id", "id");
+
+                var syncTaskStatus = UpdateAssignedUsersLinkedGroup(deviceProfile, GroupId);
+                if (redirect)
+                    if (syncTaskStatus == null)
+                        return RedirectToAction(MVC.Config.DeviceProfile.Index(deviceProfile.Id));
+                    else
+                    {
+                        syncTaskStatus.SetFinishedUrl(Url.Action(MVC.Config.DeviceProfile.Index(deviceProfile.Id)));
+                        return RedirectToAction(MVC.Config.Logging.TaskStatus(syncTaskStatus.SessionId));
+                    }
+                else
+                    return Json("OK", JsonRequestBehavior.AllowGet);
+            }
+            catch (Exception ex)
+            {
+                if (redirect)
+                    throw;
+                else
+                    return Json(string.Format("Error: {0}", ex.Message), JsonRequestBehavior.AllowGet);
+            }
+        }
        #endregion

        #region Update Properties
@@ -365,6 +438,40 @@ namespace Disco.Web.Areas.API.Controllers
            }
            throw new Exception("Invalid Boolean Value");
        }
+
+        private ScheduledTaskStatus UpdateDevicesLinkedGroup(DeviceProfile DeviceProfile, string DevicesLinkedGroup)
+        {
+            var configJson = ADManagedGroup.ValidConfigurationToJson(DeviceProfileDevicesManagedGroup.GetKey(DeviceProfile), DevicesLinkedGroup, null);
+
+            if (DeviceProfile.DevicesLinkedGroup != configJson)
+            {
+                DeviceProfile.DevicesLinkedGroup = configJson;
+                Database.SaveChanges();
+
+                var managedGroup = DeviceProfileDevicesManagedGroup.Initialize(DeviceProfile);
+                if (managedGroup != null) // Sync Group
+                    return ADManagedGroupsSyncTask.ScheduleSync(managedGroup);
+            }
+
+            return null;
+        }
+
+        private ScheduledTaskStatus UpdateAssignedUsersLinkedGroup(DeviceProfile DeviceProfile, string AssignedUsersLinkedGroup)
+        {
+            var configJson = ADManagedGroup.ValidConfigurationToJson(DeviceProfileAssignedUsersManagedGroup.GetKey(DeviceProfile), AssignedUsersLinkedGroup, null);
+
+            if (DeviceProfile.AssignedUsersLinkedGroup != configJson)
+            {
+                DeviceProfile.AssignedUsersLinkedGroup = configJson;
+                Database.SaveChanges();
+
+                var managedGroup = DeviceProfileAssignedUsersManagedGroup.Initialize(DeviceProfile);
+                if (managedGroup != null) // Sync Group
+                    return ADManagedGroupsSyncTask.ScheduleSync(managedGroup);
+            }
+
+            return null;
+        }
        #endregion

        #region Actions
@@ -1,8 +1,10 @@
 using Disco.BI;
+using Disco.BI.DocumentTemplateBI.ManagedGroups;
 using Disco.BI.Extensions;
 using Disco.Models.Repository;
 using Disco.Services.Authorization;
 using Disco.Services.Interop.ActiveDirectory;
+using Disco.Services.Tasks;
 using Disco.Services.Users;
 using Disco.Services.Web;
 using System;
@@ -30,7 +32,10 @@ namespace Disco.Web.Areas.API.Controllers
                    throw new ArgumentNullException("id");
                if (string.IsNullOrEmpty(key))
                    throw new ArgumentNullException("key");
+                
+                ScheduledTaskStatus resultTask = null;
                var documentTemplate = Database.DocumentTemplates.Find(id);
+                
                if (documentTemplate != null)
                {
                    switch (key.ToLower())
@@ -39,7 +44,7 @@ namespace Disco.Web.Areas.API.Controllers
                            UpdateDescription(documentTemplate, value);
                            break;
                        case pScope:
-                            UpdateScope(documentTemplate, value);
+                            resultTask = UpdateScope(documentTemplate, value);
                            break;
                        case pFilterExpression:
                            Authorization.Require(Claims.Config.DocumentTemplate.ConfigureFilterExpression);
@@ -57,7 +62,15 @@ namespace Disco.Web.Areas.API.Controllers
                    throw new Exception("Invalid Document Template Id");
                }
                if (redirect)
-                    return RedirectToAction(MVC.Config.DocumentTemplate.Index(documentTemplate.Id));
+                    if (resultTask == null)
+                    {
+                        return RedirectToAction(MVC.Config.DocumentTemplate.Index(documentTemplate.Id));
+                    }
+                    else
+                    {
+                        resultTask.SetFinishedUrl(Url.Action(MVC.Config.DocumentTemplate.Index(documentTemplate.Id)));
+                        return RedirectToAction(MVC.Config.Logging.TaskStatus(resultTask.SessionId));
+                    }
                else
                    return Json("OK", JsonRequestBehavior.AllowGet);
            }
@@ -163,6 +176,72 @@ namespace Disco.Web.Areas.API.Controllers
            }

        }
+
+        [DiscoAuthorize(Claims.Config.DocumentTemplate.Configure)]
+        public virtual ActionResult UpdateDevicesLinkedGroup(string id, string GroupId = null, DateTime? FilterBeginDate = null, bool redirect = false)
+        {
+            try
+            {
+                if (string.IsNullOrWhiteSpace(id))
+                    throw new ArgumentNullException("id");
+
+                var documentTemplate = Database.DocumentTemplates.Find(id);
+                if (documentTemplate == null)
+                    throw new ArgumentException("Invalid Document Template Id", "id");
+
+                var syncTaskStatus = UpdateDevicesLinkedGroup(documentTemplate, GroupId, FilterBeginDate);
+                if (redirect)
+                    if (syncTaskStatus == null)
+                        return RedirectToAction(MVC.Config.DocumentTemplate.Index(documentTemplate.Id));
+                    else
+                    {
+                        syncTaskStatus.SetFinishedUrl(Url.Action(MVC.Config.DocumentTemplate.Index(documentTemplate.Id)));
+                        return RedirectToAction(MVC.Config.Logging.TaskStatus(syncTaskStatus.SessionId));
+                    }
+                else
+                    return Json("OK", JsonRequestBehavior.AllowGet);
+            }
+            catch (Exception ex)
+            {
+                if (redirect)
+                    throw;
+                else
+                    return Json(string.Format("Error: {0}", ex.Message), JsonRequestBehavior.AllowGet);
+            }
+        }
+
+        [DiscoAuthorize(Claims.Config.DocumentTemplate.Configure)]
+        public virtual ActionResult UpdateUsersLinkedGroup(string id, string GroupId = null, DateTime? FilterBeginDate = null, bool redirect = false)
+        {
+            try
+            {
+                if (string.IsNullOrWhiteSpace(id))
+                    throw new ArgumentNullException("id");
+
+                var documentTemplate = Database.DocumentTemplates.Find(id);
+                if (documentTemplate == null)
+                    throw new ArgumentException("Invalid Document Template Id", "id");
+
+                var syncTaskStatus = UpdateUsersLinkedGroup(documentTemplate, GroupId, FilterBeginDate);
+                if (redirect)
+                    if (syncTaskStatus == null)
+                        return RedirectToAction(MVC.Config.DocumentTemplate.Index(documentTemplate.Id));
+                    else
+                    {
+                        syncTaskStatus.SetFinishedUrl(Url.Action(MVC.Config.DocumentTemplate.Index(documentTemplate.Id)));
+                        return RedirectToAction(MVC.Config.Logging.TaskStatus(syncTaskStatus.SessionId));
+                    }
+                else
+                    return Json("OK", JsonRequestBehavior.AllowGet);
+            }
+            catch (Exception ex)
+            {
+                if (redirect)
+                    throw;
+                else
+                    return Json(string.Format("Error: {0}", ex.Message), JsonRequestBehavior.AllowGet);
+            }
+        }
        #endregion

        #region Update Properties
@@ -176,28 +255,38 @@ namespace Disco.Web.Areas.API.Controllers
            }
            throw new Exception("Invalid Description");
        }
-        private void UpdateScope(Disco.Models.Repository.DocumentTemplate documentTemplate, string Scope)
+        private ScheduledTaskStatus UpdateScope(Disco.Models.Repository.DocumentTemplate documentTemplate, string Scope)
        {
-            if (!string.IsNullOrWhiteSpace(Scope))
+            if (string.IsNullOrWhiteSpace(Scope) || !Disco.Models.Repository.DocumentTemplate.DocumentTemplateScopes.ToList().Contains(Scope))
+                throw new ArgumentException("Invalid Scope", "Scope");
+
+            Database.Configuration.LazyLoadingEnabled = true;
+
+            if (documentTemplate.Scope != Scope)
            {
-                if (Disco.Models.Repository.DocumentTemplate.DocumentTemplateScopes.ToList().Contains(Scope))
+
+                documentTemplate.Scope = Scope;
+
+                if (documentTemplate.Scope != Disco.Models.Repository.DocumentTemplate.DocumentTemplateScopes.Job &&
+                    documentTemplate.JobSubTypes != null)
                {
-                    Database.Configuration.LazyLoadingEnabled = true;
-
-                    documentTemplate.Scope = Scope;
-
-                    if (documentTemplate.Scope != Disco.Models.Repository.DocumentTemplate.DocumentTemplateScopes.Job &&
-                        documentTemplate.JobSubTypes != null)
-                    {
-                        foreach (var st in documentTemplate.JobSubTypes.ToArray())
-                            documentTemplate.JobSubTypes.Remove(st);
-                    }
-
-                    Database.SaveChanges();
-                    return;
+                    foreach (var st in documentTemplate.JobSubTypes.ToArray())
+                        documentTemplate.JobSubTypes.Remove(st);
                }
+
+                Database.SaveChanges();
+
+                // Trigger Managed Group Sync
+                var managedGroups = new ADManagedGroup[] {
+                    DocumentTemplateDevicesManagedGroup.Initialize(documentTemplate),
+                    DocumentTemplateUsersManagedGroup.Initialize(documentTemplate)
+                };
+
+                if (managedGroups.Any(mg => mg != null)) // Sync Group
+                    return ADManagedGroupsSyncTask.ScheduleSync(managedGroups.Where(mg => mg != null));
            }
-            throw new Exception("Invalid Scope");
+
+            return null;
        }
        private void UpdateFilterExpression(Disco.Models.Repository.DocumentTemplate documentTemplate, string FilterExpression)
        {
@@ -257,6 +346,40 @@ namespace Disco.Web.Areas.API.Controllers
            }
            Database.SaveChanges();
        }
+
+        private ScheduledTaskStatus UpdateDevicesLinkedGroup(DocumentTemplate DocumentTemplate, string DevicesLinkedGroup, DateTime? FilterBeginDate)
+        {
+            var configJson = ADManagedGroup.ValidConfigurationToJson(DocumentTemplateDevicesManagedGroup.GetKey(DocumentTemplate), DevicesLinkedGroup, FilterBeginDate);
+
+            if (DocumentTemplate.DevicesLinkedGroup != configJson)
+            {
+                DocumentTemplate.DevicesLinkedGroup = configJson;
+                Database.SaveChanges();
+
+                var managedGroup = DocumentTemplateDevicesManagedGroup.Initialize(DocumentTemplate);
+                if (managedGroup != null) // Sync Group
+                    return ADManagedGroupsSyncTask.ScheduleSync(managedGroup);
+            }
+
+            return null;
+        }
+
+        private ScheduledTaskStatus UpdateUsersLinkedGroup(DocumentTemplate DocumentTemplate, string UsersLinkedGroup, DateTime? FilterBeginDate)
+        {
+            var configJson = ADManagedGroup.ValidConfigurationToJson(DocumentTemplateUsersManagedGroup.GetKey(DocumentTemplate), UsersLinkedGroup, FilterBeginDate);
+
+            if (DocumentTemplate.UsersLinkedGroup != configJson)
+            {
+                DocumentTemplate.UsersLinkedGroup = configJson;
+                Database.SaveChanges();
+
+                var managedGroup = DocumentTemplateUsersManagedGroup.Initialize(DocumentTemplate);
+                if (managedGroup != null) // Sync Group
+                    return ADManagedGroupsSyncTask.ScheduleSync(managedGroup);
+            }
+
+            return null;
+        }
        #endregion

        #region Actions
@@ -340,7 +463,7 @@ namespace Disco.Web.Areas.API.Controllers
                    if (results != null)
                        return Json(results, JsonRequestBehavior.AllowGet);
                }
-                
+
            }
            return Json(null, JsonRequestBehavior.AllowGet);
        }
@@ -19,7 +19,7 @@ namespace Disco.Web.Areas.API.Controllers
        [DiscoAuthorize(Claims.Config.System.Show)]
        public virtual ActionResult UpdateLastNetworkLogonDates()
        {
-            var taskStatus = Disco.Services.Interop.ActiveDirectory.ADTaskUpdateNetworkLogonDates.ScheduleImmediately();
+            var taskStatus = Disco.Services.Interop.ActiveDirectory.ADNetworkLogonDatesUpdateTask.ScheduleImmediately();

            return RedirectToAction(MVC.Config.Logging.TaskStatus(taskStatus.SessionId));
        }
@@ -294,6 +294,17 @@ namespace Disco.Web.Areas.API.Controllers
            return Json(results, JsonRequestBehavior.AllowGet);
        }

+        [DiscoAuthorizeAny(Claims.Config.UserFlag.Configure)]
+        public virtual ActionResult SearchGroupSubjects(string term)
+        {
+            var groupResults = ActiveDirectory.SearchADGroups(term).Cast<IADObject>();
+
+            var results = groupResults.OrderBy(r => r.SamAccountName)
+                .Select(r => Models.Shared.SubjectDescriptorModel.FromActiveDirectoryObject(r)).ToList();
+
+            return Json(results, JsonRequestBehavior.AllowGet);
+        }
+
        [DiscoAuthorizeAny(Claims.DiscoAdminAccount, Claims.Config.JobQueue.Configure)]
        public virtual ActionResult Subject(string Id)
        {
@@ -305,6 +316,22 @@ namespace Disco.Web.Areas.API.Controllers
                return Json(Models.Shared.SubjectDescriptorModel.FromActiveDirectoryObject(subject), JsonRequestBehavior.AllowGet);
        }

+        [DiscoAuthorizeAny(Claims.Config.UserFlag.Configure)]
+        public virtual ActionResult SyncActiveDirectoryManagedGroup(string id, string redirectUrl = null)
+        {
+            ADManagedGroup managedGroup;
+            
+            if (!ActiveDirectory.Context.ManagedGroups.TryGetValue(id, out managedGroup))
+                throw new ArgumentException("Unknown Managed Group Key");
+
+            var taskStatus = ADManagedGroupsSyncTask.ScheduleSync(managedGroup);
+            
+            if (redirectUrl != null)
+                taskStatus.SetFinishedUrl(redirectUrl);
+
+            return RedirectToAction(MVC.Config.Logging.TaskStatus(taskStatus.SessionId));
+        }
+
        #endregion

        #region Proxy Settings
@@ -58,10 +58,7 @@ namespace Disco.Web.Areas.API.Controllers
        [DiscoAuthorize(Claims.User.Actions.AddAttachments)]
        public virtual ActionResult AttachmentUpload(string id, string Domain, string Comments)
        {
-            if (string.IsNullOrEmpty(Domain))
-                id = ActiveDirectory.Context.PrimaryDomain.NetBiosName + @"\" + id;
-            else
-                id = Domain + @"\" + id;
+            id = ActiveDirectory.ParseDomainAccountId(id, Domain);

            var u = Database.Users.Find(id);
            if (u != null)
@@ -120,10 +117,7 @@ namespace Disco.Web.Areas.API.Controllers
        [DiscoAuthorize(Claims.User.ShowAttachments)]
        public virtual ActionResult Attachments(string id, string Domain)
        {
-            if (string.IsNullOrEmpty(Domain))
-                id = ActiveDirectory.Context.PrimaryDomain.NetBiosName + @"\" + id;
-            else
-                id = Domain + @"\" + id;
+            id = ActiveDirectory.ParseDomainAccountId(id, Domain);

            var u = Database.Users.Include("UserAttachments.DocumentTemplate").Include("UserAttachments.TechUser").Where(m => m.UserId == id).FirstOrDefault();
            if (u != null)
@@ -167,10 +161,7 @@ namespace Disco.Web.Areas.API.Controllers
            if (string.IsNullOrEmpty(DocumentTemplateId))
                throw new ArgumentNullException("AttachmentTypeId");

-            if (string.IsNullOrEmpty(Domain))
-                id = ActiveDirectory.Context.PrimaryDomain.NetBiosName + @"\" + id;
-            else
-                id = Domain + @"\" + id;
+            id = ActiveDirectory.ParseDomainAccountId(id, Domain);

            var user = Database.Users.Find(id);
            if (user != null)
@@ -1,5 +1,7 @@
 using Disco.Models.Repository;
+using Disco.Models.Services.Interop.ActiveDirectory;
 using Disco.Services.Authorization;
+using Disco.Services.Interop.ActiveDirectory;
 using Disco.Services.Tasks;
 using Disco.Services.Users.UserFlags;
 using Disco.Services.Web;
@@ -15,6 +17,8 @@ namespace Disco.Web.Areas.API.Controllers
        const string pDescription = "description";
        const string pIcon = "icon";
        const string pIconColour = "iconcolour";
+        const string pAssignedUsersLinkedGroup = "assigneduserslinkedgroup";
+        const string pAssignedUserDevicesLinkedGroup = "assigneduserdeviceslinkedgroup";

        [DiscoAuthorize(Claims.Config.UserFlag.Configure)]
        public virtual ActionResult Update(int id, string key, string value = null, Nullable<bool> redirect = null)
@@ -44,6 +48,12 @@ namespace Disco.Web.Areas.API.Controllers
                        case pIconColour:
                            UpdateIconColour(flag, value);
                            break;
+                        case pAssignedUsersLinkedGroup:
+                            UpdateAssignedUsersLinkedGroup(flag, value);
+                            break;
+                        case pAssignedUserDevicesLinkedGroup:
+                            UpdateAssignedUserDevicesLinkedGroup(flag, value);
+                            break;
                        default:
                            throw new Exception("Invalid Update Key");
                    }
@@ -106,7 +116,7 @@ namespace Disco.Web.Areas.API.Controllers
                }
                else
                {
-                    return Json("Invalid User Flag Id", JsonRequestBehavior.AllowGet);
+                    throw new ArgumentException("Invalid User Flag Id", "id");
                }
                if (redirect)
                    return RedirectToAction(MVC.Config.UserFlag.Index(UserFlag.Id));
@@ -121,6 +131,72 @@ namespace Disco.Web.Areas.API.Controllers
                    return Json(string.Format("Error: {0}", ex.Message), JsonRequestBehavior.AllowGet);
            }
        }
+        [DiscoAuthorize(Claims.Config.UserFlag.Configure)]
+        public virtual ActionResult UpdateAssignedUsersLinkedGroup(int id, string GroupId = null, bool redirect = false)
+        {
+            try
+            {
+                if (id < 0)
+                    throw new ArgumentOutOfRangeException("id");
+
+                var UserFlag = Database.UserFlags.Find(id);
+                if (UserFlag == null)
+                    throw new ArgumentException("Invalid User Flag Id", "id");
+
+
+                var syncTaskStatus = UpdateAssignedUsersLinkedGroup(UserFlag, GroupId);
+                if (redirect)
+                    if (syncTaskStatus == null)
+                        return RedirectToAction(MVC.Config.UserFlag.Index(UserFlag.Id));
+                    else
+                    {
+                        syncTaskStatus.SetFinishedUrl(Url.Action(MVC.Config.UserFlag.Index(UserFlag.Id)));
+                        return RedirectToAction(MVC.Config.Logging.TaskStatus(syncTaskStatus.SessionId));
+                    }
+                else
+                    return Json("OK", JsonRequestBehavior.AllowGet);
+            }
+            catch (Exception ex)
+            {
+                if (redirect)
+                    throw;
+                else
+                    return Json(string.Format("Error: {0}", ex.Message), JsonRequestBehavior.AllowGet);
+            }
+        }
+        [DiscoAuthorize(Claims.Config.UserFlag.Configure)]
+        public virtual ActionResult UpdateAssignedUserDevicesLinkedGroup(int id, string GroupId = null, bool redirect = false)
+        {
+            try
+            {
+                if (id < 0)
+                    throw new ArgumentOutOfRangeException("id");
+
+                var UserFlag = Database.UserFlags.Find(id);
+                if (UserFlag == null)
+                    throw new ArgumentException("Invalid User Flag Id", "id");
+
+
+                var syncTaskStatus = UpdateAssignedUserDevicesLinkedGroup(UserFlag, GroupId);
+                if (redirect)
+                    if (syncTaskStatus == null)
+                        return RedirectToAction(MVC.Config.UserFlag.Index(UserFlag.Id));
+                    else
+                    {
+                        syncTaskStatus.SetFinishedUrl(Url.Action(MVC.Config.UserFlag.Index(UserFlag.Id)));
+                        return RedirectToAction(MVC.Config.Logging.TaskStatus(syncTaskStatus.SessionId));
+                    }
+                else
+                    return Json("OK", JsonRequestBehavior.AllowGet);
+            }
+            catch (Exception ex)
+            {
+                if (redirect)
+                    throw;
+                else
+                    return Json(string.Format("Error: {0}", ex.Message), JsonRequestBehavior.AllowGet);
+            }
+        }
        #endregion

        #region Update Properties
@@ -131,37 +207,98 @@ namespace Disco.Web.Areas.API.Controllers
            if (string.IsNullOrWhiteSpace(IconColour))
                throw new ArgumentNullException("IconColour");

-            UserFlag.Icon = Icon;
-            UserFlag.IconColour = IconColour;
-            UserFlagService.Update(Database, UserFlag);
+            if (UserFlag.Icon != Icon ||
+                UserFlag.IconColour != IconColour)
+            {
+                UserFlag.Icon = Icon;
+                UserFlag.IconColour = IconColour;
+                UserFlagService.Update(Database, UserFlag);
+            }
        }
        private void UpdateIcon(UserFlag UserFlag, string Icon)
        {
            if (string.IsNullOrWhiteSpace(Icon))
                throw new ArgumentNullException("Icon");

-            UserFlag.Icon = Icon;
-            UserFlagService.Update(Database, UserFlag);
+            if (UserFlag.Icon != Icon)
+            {
+                UserFlag.Icon = Icon;
+                UserFlagService.Update(Database, UserFlag);
+            }
        }
        private void UpdateIconColour(UserFlag UserFlag, string IconColour)
        {
            if (string.IsNullOrWhiteSpace(IconColour))
                throw new ArgumentNullException("IconColour");

-            UserFlag.IconColour = IconColour;
-            UserFlagService.Update(Database, UserFlag);
+            if (UserFlag.IconColour != IconColour)
+            {
+                UserFlag.IconColour = IconColour;
+                UserFlagService.Update(Database, UserFlag);
+            }
        }

        private void UpdateName(UserFlag UserFlag, string Name)
        {
-            UserFlag.Name = Name;
-            UserFlagService.Update(Database, UserFlag);
+            if (UserFlag.Name != Name)
+            {
+                UserFlag.Name = Name;
+                UserFlagService.Update(Database, UserFlag);
+            }
        }

        private void UpdateDescription(UserFlag UserFlag, string Description)
        {
-            UserFlag.Description = Description;
-            UserFlagService.Update(Database, UserFlag);
+            if (UserFlag.Description != Description)
+            {
+                UserFlag.Description = Description;
+                UserFlagService.Update(Database, UserFlag);
+            }
+        }
+
+        private ScheduledTaskStatus UpdateAssignedUsersLinkedGroup(UserFlag UserFlag, string AssignedUsersLinkedGroup)
+        {
+            var configJson = ADManagedGroup.ValidConfigurationToJson(UserFlagUsersManagedGroup.GetKey(UserFlag), AssignedUsersLinkedGroup, null);
+
+            if (UserFlag.UsersLinkedGroup != configJson)
+            {
+                UserFlag.UsersLinkedGroup = configJson;
+                UserFlagService.Update(Database, UserFlag);
+
+                if (UserFlag.UsersLinkedGroup != null)
+                {
+                    // Sync Group
+                    UserFlagUsersManagedGroup managedGroup;
+                    if (UserFlagUsersManagedGroup.TryGetManagedGroup(UserFlag, out managedGroup))
+                    {
+                        return ADManagedGroupsSyncTask.ScheduleSync(managedGroup);
+                    }
+                }
+            }
+
+            return null;
+        }
+        private ScheduledTaskStatus UpdateAssignedUserDevicesLinkedGroup(UserFlag UserFlag, string AssignedUserDevicesLinkedGroup)
+        {
+            var configJson = ADManagedGroup.ValidConfigurationToJson(UserFlagUserDevicesManagedGroup.GetKey(UserFlag), AssignedUserDevicesLinkedGroup, null);
+
+            if (UserFlag.UserDevicesLinkedGroup != configJson)
+            {
+                UserFlag.UserDevicesLinkedGroup = configJson;
+                UserFlagService.Update(Database, UserFlag);
+
+                if (UserFlag.UserDevicesLinkedGroup != null)
+                {
+                    // Sync Group
+                    UserFlagUserDevicesManagedGroup managedGroup;
+                    if (UserFlagUserDevicesManagedGroup.TryGetManagedGroup(UserFlag, out managedGroup))
+                    {
+                        return ADManagedGroupsSyncTask.ScheduleSync(managedGroup);
+                    }
+                }
+            }
+
+            return null;
        }
        #endregion

@@ -218,7 +355,7 @@ namespace Disco.Web.Areas.API.Controllers
                throw new ArgumentException("Invalid User Flag Id", "id");

            var assignedUsers = Database.UserFlagAssignments.Where(a => a.UserFlagId == userFlag.Id && !a.RemovedDate.HasValue).OrderBy(a => a.UserId).Select(a => a.UserId).ToList();
-            
+
            return Json(assignedUsers, JsonRequestBehavior.AllowGet);
        }
        #endregion