Update_local_password_for_jamf_connect

adminName=$4
adminPass=$5
rescueUser="rescue"

if [[ -z "$adminName" ]] || [[ -z "$adminPass" ]] ; then
	echo "admin name or admin pass missing"
	exit 1
fi

#Get logged in user

loggedInUser=$( echo "show State:/Users/ConsoleUser" | scutil | awk '/Name :/ && ! /loginwindow/ { print $3 }' )

if [[ -z "$loggedInUser" ]] || [[  "$loggedInUser" == 'root' ]] || [[ "$loggedInUser" == "loginwindow" ]] ; then
	echo "Failed to gather loggedInUser correctly"
	exit 1
else
	echo "loggedInUser is $loggedInUser"
fi
loggedInUID=$(id -u "$loggedInUser")

if [[ "$loggedInUser"  == "$adminName" ]] ; then
	PROCEED="button returned:Yes"
else
DESCRIPTION="WARNING: This is designed to be used when the password the the primary account for this computer has been forgotten. Please use only with the assistance of Helpdesk."

PROCEED="$(osascript -e 'display dialog "'"$DESCRIPTION"'" buttons {"Yes", "No"} default button "Yes"')"
fi

if [ "$PROCEED" = "button returned:Yes" ]; then
    echo "Yes, continue with script."
else
    echo "No, cancel script."
    exit 1
fi



#### SET UP DISPLAY DIALOG FUNCTION
#### SET UP DISPLAY DIALOG FUNCTION
DisplayDialog(){
	local dialogText="$1"
	echo "$dialogText"
	#Log "Display Dialog: $dialogText"
	cmd="display dialog \"$dialogText\" buttons {\"Continue\"} default button 1 giving up after 180"
	if [[ -z "$loggedInUID" ]] || [[ -z "$loggedInUser" ]] ; then 
		/usr/bin/osascript -e "$cmd"
	else
		/bin/launchctl asuser "$loggedInUID" sudo -iu "$loggedInUser" /usr/bin/osascript -e "$cmd"
	fi
}


### MAKE SURE WE HAVE BOTH VARIABLES
if [[ -z "$adminName" ]] || [[ -z "$adminPass" ]] ; then 
	DisplayDialog "Either admin username or admin password is missing"
	exit 1
fi



echo " "
echo "Checking admin passsword"
adminPassCheck=$(/usr/bin/dscl /Local/Default -authonly "$adminName" "$adminPass")
if [[ -z "$adminPassCheck" ]]; then
	echo "Continue"
else
	DisplayDialog "admin Password not set correctly"
	exit 1
fi


echo " "
echo "Making sure password is eligible for Jamf Connect password reset"

check4AD="$(/usr/bin/dscl localhost -list . | grep "Active Directory")"

jamfConnect="/Applications/Jamf Connect.app"

NETACCLIST=$(dscl . list /Users OriginalNodeName | awk '{print $1}' 2>/dev/null)

if [ "${check4AD}" != "Active Directory" ]; then
	echo "computer not bound to AD"
else
	DisplayDialog "Computer bound to AD"
	exit 1
fi

if [[ -e "$jamfConnect" ]] ; then
	echo "jamf connect installed"
else
	DisplayDialog "Jamf connect not installed"
	exit 1
fi

if [[ -n "$NETACCLIST" ]] ; then
	DisplayDialog "mobile accounts found."
	exit 1
else
	echo "no mobile accounts"
fi


#
## get username to change
echo "prompting user for Account Username"
userName=$(/bin/launchctl asuser "$loggedInUID" sudo -iu "$loggedInUser" /usr/bin/osascript<<END
text returned of (display dialog "Enter the username whose password you want to change:" default answer "" buttons {"Continue"} default button 1 giving up after 60 )
END
)

## CANNOT CHANGE PASSWORD OF LOGGED IN USER.
## this doesn't make sure the user isn't logged in, but it does make sure the user isn't the current user
if [[ "$userName" == "$loggedInUser" ]] ; then
	DisplayDialog "You cannot change the password of the currently logged in user."
	exit 1
elif [[ "$userName" == "$adminName" ]] || [[ "$userName" == "$rescueUser" ]] ; then
	DisplayDialog "You cannot change the password of $userName."
	exit 1
fi

otherUsersInstalled="$(dscl . list /Users UniqueID | awk '$2 > 499 { print $1 }' | grep -v "${adminName}" | grep -v 'rescue' )"

userCheck="$(echo "${otherUsersInstalled}" | grep "${userName}")"

if [[ -z "${userCheck}" ]] ; then 
	DisplayDialog "$userName not found computer userlist: $otherUsersInstalled"
	exit 1
else
	echo "$userName found computer userlist"	
fi


echo "prompting user for Account Password"
userPass=$(/bin/launchctl asuser "$loggedInUID" sudo -iu "$loggedInUser" /usr/bin/osascript<<END
text returned of (display dialog "Enter $userName's new password that matches AD." default answer "" buttons {"Continue"} default button 1 giving up after 60 )
END
)

echo "prompting user for Account Password"
verifyPass=$(/bin/launchctl asuser "$loggedInUID" sudo -iu "$loggedInUser" /usr/bin/osascript<<END
text returned of (display dialog "Verify $userName's new password." default answer "" buttons {"Continue"} default button 1 giving up after 60 )
END
)


if [[ "${userPass}" == "${verifyPass}" ]] ; then
	echo "userPass and verifyPass match"
else
	DisplayDialog "Passwords do not match."
	exit 1
fi

# WITH HIDDEN ANSWER
# userPass=$(/usr/bin/osascript<<END
# tell application "System Events"
# activate
# set the answer to text returned of (display dialog "Enter $loggedInUser's Current Account Password:" default answer "" with hidden answer buttons {"Continue"} default button 1)
# end tell
# END
# )


sysadminctl -adminUser "${adminName}" -adminPassword "${adminPass}" -resetPasswordFor "${userName}" -newPassword "${userPass}"

echo " "
echo "Checking admin passsword"
userPassCheck=$(/usr/bin/dscl /Local/Default -authonly "$userName" "$userPass")
if [[ -z "$userPassCheck" ]]; then
	echo "Continue"
	DisplayDialog "Password Change Successful"
else
	echo "user Password not set correctly"
	DisplayDialog "Password Change Failed"
	exit 1
fi