Skip to content

Commit 20ba91b

Browse files
KelvinTegelaarKelvinTegelaar
committed
Add reporting jit
1 parent 9165db4 commit 20ba91b

File tree

3 files changed

+37
-5
lines changed

3 files changed

+37
-5
lines changed

‎Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecJITAdmin.ps1‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@ function Invoke-ExecJITAdmin {
3232
'UserPrincipalName' = $Username
3333
}
3434
Expiration = $Expiration
35+
StartDate = $Start
3536
Reason = $Request.Body.reason
3637
Action = 'Create'
3738
TenantFilter = $TenantFilter
@@ -152,6 +153,7 @@ function Invoke-ExecJITAdmin {
152153
Action = 'AddRoles'
153154
Reason = $Request.Body.Reason
154155
Expiration = $Expiration
156+
StartDate = $Start
155157
Headers = $Headers
156158
APIName = $APIName
157159
}
@@ -173,7 +175,7 @@ function Invoke-ExecJITAdmin {
173175
}
174176
Add-CIPPScheduledTask -Task $TaskBody -hidden $false
175177
if ($Request.Body.userAction -ne 'create') {
176-
Set-CIPPUserJITAdminProperties -TenantFilter $TenantFilter -UserId $Request.Body.existingUser.value -Expiration $Expiration -Reason $Request.Body.Reason
178+
Set-CIPPUserJITAdminProperties -TenantFilter $TenantFilter -UserId $Request.Body.existingUser.value -Expiration $Expiration -StartDate $Start -Reason $Request.Body.Reason -CreatedBy (([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($Headers.'x-ms-client-principal')) | ConvertFrom-Json).userDetails)
177179
}
178180
$Results.Add("Scheduling JIT Admin enable task for $Username")
179181
} else {

‎Modules/CIPPCore/Public/Set-CIPPUserJITAdmin.ps1‎

Lines changed: 27 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,7 @@ function Set-CIPPUserJITAdmin {
4242
[ValidateSet('Create', 'AddRoles', 'RemoveRoles', 'DeleteUser', 'DisableUser')]
4343
[string]$Action,
4444
[datetime]$Expiration,
45+
[datetime]$StartDate,
4546
[string]$Reason = 'No reason provided',
4647
$Headers,
4748
[string]$APIName = 'Set-CIPPUserJITAdmin'
@@ -72,7 +73,9 @@ function Set-CIPPUserJITAdmin {
7273
$Schema.id = @{
7374
jitAdminEnabled = $false
7475
jitAdminExpiration = $Expiration.ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ')
76+
jitAdminStartDate = if ($StartDate) { $StartDate.ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ') } else { $null }
7577
jitAdminReason = $Reason
78+
jitAdminCreatedBy = if ($Headers) { ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($Headers.'x-ms-client-principal')) | ConvertFrom-Json).userDetails } else { 'Unknown' }
7679
}
7780
}
7881
$Json = ConvertTo-Json -Depth 5 -InputObject $Body
@@ -83,7 +86,16 @@ function Set-CIPPUserJITAdmin {
8386
if ($PasswordLink) {
8487
$Password = $PasswordLink
8588
}
86-
Write-LogMessage -Headers $Headers -API $APIName -tenant $TenantFilter -message "Created JIT Admin user: $($User.UserPrincipalName). Reason: $Reason" -Sev 'Info'
89+
$LogData = @{
90+
UserPrincipalName = $User.UserPrincipalName
91+
Action = 'Create'
92+
Reason = $Reason
93+
StartDate = if ($StartDate) { $StartDate.ToString('o') } else { (Get-Date).ToString('o') }
94+
Expiration = $Expiration.ToString('o')
95+
ExpirationUTC = $Expiration.ToUniversalTime().ToString('o')
96+
CreatedBy = if ($Headers) { ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($Headers.'x-ms-client-principal')) | ConvertFrom-Json).userDetails } else { 'Unknown' }
97+
}
98+
Write-LogMessage -Headers $Headers -API $APIName -tenant $TenantFilter -message "Created JIT Admin user: $($User.UserPrincipalName). Reason: $Reason" -Sev 'Info' -LogData $LogData
8799
[PSCustomObject]@{
88100
id = $NewUser.id
89101
userPrincipalName = $NewUser.userPrincipalName
@@ -116,9 +128,21 @@ function Set-CIPPUserJITAdmin {
116128
} catch {}
117129
}
118130

119-
Set-CIPPUserJITAdminProperties -TenantFilter $TenantFilter -UserId $UserObj.id -Enabled -Expiration $Expiration -Reason $Reason | Out-Null
131+
Set-CIPPUserJITAdminProperties -TenantFilter $TenantFilter -UserId $UserObj.id -Enabled -Expiration $Expiration -StartDate $StartDate -Reason $Reason -CreatedBy (if ($Headers) { ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($Headers.'x-ms-client-principal')) | ConvertFrom-Json).userDetails } else { 'Unknown' }) | Out-Null
120132
$Message = "Added admin roles to user $($UserObj.displayName) ($($UserObj.userPrincipalName)). Reason: $Reason"
121-
Write-LogMessage -Headers $Headers -API $APIName -tenant $TenantFilter -message $Message -Sev 'Info'
133+
$LogData = @{
134+
UserPrincipalName = $UserObj.userPrincipalName
135+
UserId = $UserObj.id
136+
DisplayName = $UserObj.displayName
137+
Action = 'AddRoles'
138+
Roles = $Roles
139+
Reason = $Reason
140+
StartDate = if ($StartDate) { $StartDate.ToString('o') } else { (Get-Date).ToString('o') }
141+
Expiration = $Expiration.ToString('o')
142+
ExpirationUTC = $Expiration.ToUniversalTime().ToString('o')
143+
CreatedBy = if ($Headers) { ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($Headers.'x-ms-client-principal')) | ConvertFrom-Json).userDetails } else { 'Unknown' }
144+
}
145+
Write-LogMessage -Headers $Headers -API $APIName -tenant $TenantFilter -message $Message -Sev 'Info' -LogData $LogData
122146
return "Added admin roles to user $($UserObj.displayName) ($($UserObj.userPrincipalName))"
123147
}
124148
'RemoveRoles' {

‎Modules/CIPPCore/Public/Set-CIPPUserJITAdminProperties.ps1‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,10 @@ function Set-CIPPUserJITAdminProperties {
55
[string]$UserId,
66
[switch]$Enabled,
77
$Expiration,
8+
$StartDate,
89
[switch]$Clear,
9-
[string]$Reason
10+
[string]$Reason,
11+
[string]$CreatedBy
1012
)
1113
try {
1214
$Schema = Get-CIPPSchemaExtensions | Where-Object { $_.id -match '_cippUser' } | Select-Object -First 1
@@ -15,15 +17,19 @@ function Set-CIPPUserJITAdminProperties {
1517
"$($Schema.id)" = @{
1618
jitAdminEnabled = $null
1719
jitAdminExpiration = $null
20+
jitAdminStartDate = $null
1821
jitAdminReason = $null
22+
jitAdminCreatedBy = $null
1923
}
2024
}
2125
} else {
2226
$Body = [PSCustomObject]@{
2327
"$($Schema.id)" = @{
2428
jitAdminEnabled = $Enabled.IsPresent
2529
jitAdminExpiration = $Expiration.ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ')
30+
jitAdminStartDate = if ($StartDate) { $StartDate.ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ') } else { $null }
2631
jitAdminReason = $Reason
32+
jitAdminCreatedBy = $CreatedBy
2733
}
2834
}
2935
}

0 commit comments

Comments
 (0)