From 1fe20064046c9a86ca1a7442cbc8e4e120dad15d Mon Sep 17 00:00:00 2001
From: Alejandro Rosales <alejandro.rosales@lasalle.mx>
Date: Tue, 8 Sep 2026 11:37:35 -0600
Subject: [PATCH] Handle absent AD role groups during deployment

---
 scripts/Deploy-AuthBroker.ps1 | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/scripts/Deploy-AuthBroker.ps1 b/scripts/Deploy-AuthBroker.ps1
index 9a2d762..6e590af 100644
--- a/scripts/Deploy-AuthBroker.ps1
+++ b/scripts/Deploy-AuthBroker.ps1
@@ -140,7 +140,12 @@ foreach ($definition in $roleGroupDefinitions) {
         throw "$($definition.Role)GroupDn must identify a security group beneath BaseDn."
     }
 
-    $roleGroup = Get-ADGroup -Identity $definition.Dn -Server $LdapHost -ErrorAction SilentlyContinue
+    try {
+        $roleGroup = Get-ADGroup -Identity $definition.Dn -Server $LdapHost -ErrorAction Stop
+    }
+    catch [Microsoft.ActiveDirectory.Management.ADIdentityNotFoundException] {
+        $roleGroup = $null
+    }
     if (-not $roleGroup -and $CreateMissingOus) {
         $groupDnMatch = [regex]::Match($definition.Dn, '^CN=(?<Name>[^,]+),(?<Path>.+)$', [Text.RegularExpressions.RegexOptions]::IgnoreCase)
         if (-not $groupDnMatch.Success) {