Local groups: verify external-principal membership on a live array and investigate directory-services/local/externals

[dmann000]

Source: field feedback. Follow-up to #36 and to the external-AD-user to local-group workflow.

Context

New-PfbLocalGroupMember posts to directory-services/local/groups/members with body { members: [ { member: { name } } ] }, which is the correct endpoint for adding a member (including an external AD principal) to a local group.

Field feedback reported that adding an external user via a different endpoint, directory-services/local/users/members (with member_names / local_directory_service_names), failed with Local user was not found (same result when using a SID). It was also observed that members added through the GUI come back with resource_type = directory-services/local/externals, and that there appears to be an endpoint directory-services/local/externals that is not present in the published swagger/redoc.

So there are two open questions: (a) does adding an external principal via groups/members with a bare { member: { name } } actually succeed on a real array, or does the array require the externals resource type; and (b) is directory-services/local/externals a real (currently undocumented) endpoint.

Tasks

• Run Tests/LocalGroupSharePermissions.E2E.Tests.ps1 against a real AD-joined FlashBlade to confirm New-PfbLocalGroupMember accepts an external AD principal (DOMAIN\user) end to end: member added, visible via Get-PfbLocalGroupMember, and usable in an SMB share grant.
• If the array requires the external externals resource type, add handling for it, and check whether directory-services/local/externals exists in the 2.28 spec / capability map.
• Document the supported path clearly: use New-PfbLocalGroupMember (groups/members), not users/members, for external principals. The users/members path is for local (non-external) users and is tracked under Local directory services — local user/group cmdlets #36.

Acceptance

A green live E2E run proving external-AD-user to local-group to SMB share, plus a documented and tested path. Relates to #36.