Skip to content

Commit 46e3849

Browse files
pull[bot]pull[bot]
authored
Merge pull request #158 from KelvinTegelaar/dev
[pull] dev from KelvinTegelaar:dev
2 parents 404aa09 + 5d0d12a commit 46e3849

File tree

3 files changed

+238
-71
lines changed

3 files changed

+238
-71
lines changed

‎Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Tenant/GDAP/Invoke-ExecGDAPAccessAssignment.ps1‎

Lines changed: 143 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,143 @@
1+
function Invoke-ExecGDAPAccessAssignment {
2+
<#
3+
.FUNCTIONALITY
4+
Entrypoint,AnyTenant
5+
.ROLE
6+
Tenant.Relationship.ReadWrite
7+
#>
8+
[CmdletBinding()]
9+
param($Request, $TriggerMetadata)
10+
11+
$APIName = $Request.Params.CIPPEndpoint
12+
Write-LogMessage -headers $Request.Headers -API $APINAME -message 'Accessed this API' -Sev 'Debug'
13+
14+
$Action = $Request.Body.Action ?? $Request.Query.Action
15+
$Id = $Request.Body.Id ?? $Request.Query.Id
16+
17+
switch ($Action) {
18+
'ResetMappings' {
19+
$RoleTemplateId = $Request.Body.RoleTemplateId
20+
21+
if (-not $RoleTemplateId) {
22+
$Body = @{
23+
Results = @{
24+
state = 'error'
25+
resultText = 'RoleTemplateId is required'
26+
}
27+
}
28+
} else {
29+
$GDAPRoleTemplatesTable = Get-CIPPTable -TableName 'GDAPRoleTemplates'
30+
$Mappings = Get-CIPPAzDataTableEntity @GDAPRoleTemplatesTable -Filter "PartitionKey eq 'RoleTemplate' and RowKey eq '$($RoleTemplateId)'" | Select-Object -ExpandProperty RoleMappings | ConvertFrom-Json
31+
32+
$RelationshipRequests = @(
33+
@{
34+
'id' = 'getRelationship'
35+
'url' = "tenantRelationships/delegatedAdminRelationships/$Id"
36+
'method' = 'GET'
37+
}
38+
@{
39+
'id' = 'getAccessAssignments'
40+
'url' = "tenantRelationships/delegatedAdminRelationships/$Id/accessAssignments"
41+
'method' = 'GET'
42+
}
43+
)
44+
45+
$RelationshipResults = New-GraphBulkRequest -Requests $RelationshipRequests -NoAuthCheck $true
46+
$Relationship = ($RelationshipResults | Where-Object id -EQ 'getRelationship').body
47+
$AccessAssignments = ($RelationshipResults | Where-Object id -EQ 'getAccessAssignments').body.value
48+
49+
$Groups = New-GraphGetRequest -Uri "https://graph.microsoft.com/beta/groups?`$top=999&`$select=id,displayName&`$filter=securityEnabled eq true" -asApp $true -NoAuthCheck $true
50+
51+
$Requests = [System.Collections.Generic.List[object]]::new()
52+
$Messages = [System.Collections.Generic.List[object]]::new()
53+
54+
foreach ($AccessAssignment in $AccessAssignments) {
55+
if ($Mappings.GroupId -notcontains $AccessAssignment.accessContainer.accessContainerId -and $AccessAssignment.status -notin @('deleting', 'deleted', 'error')) {
56+
Write-Warning "Deleting access assignment for $($AccessAssignment.accessContainer.accessContainerId)"
57+
$Group = $Groups | Where-Object id -EQ $AccessAssignment.accessContainer.accessContainerId
58+
$Requests.Add(@{
59+
'id' = "delete-$($AccessAssignment.id)"
60+
'url' = "tenantRelationships/delegatedAdminRelationships/$Id/accessAssignments/$($AccessAssignment.id)"
61+
'method' = 'DELETE'
62+
'headers' = @{
63+
'If-Match' = $AccessAssignment.'@odata.etag'
64+
}
65+
})
66+
67+
$Messages.Add(@{
68+
'id' = $AccessAssignment.id
69+
'message' = "Deleting access assignment for $($Group.displayName)"
70+
})
71+
72+
}
73+
}
74+
75+
foreach ($Mapping in $Mappings) {
76+
if ($AccessAssignments.accessContainer.accessContainerId -notcontains $Mapping.GroupId -and $Relationship.accessDetails.unifiedRoles.roleDefinitionId -contains $Mapping.roleDefinitionId) {
77+
Write-Information "Creating access assignment for $($Mapping.GroupId)"
78+
$Requests.Add(@{
79+
'id' = "create-$($Mapping.GroupId)"
80+
'url' = "tenantRelationships/delegatedAdminRelationships/$Id/accessAssignments"
81+
'method' = 'POST'
82+
'body' = @{
83+
'accessDetails' = @{
84+
'unifiedRoles' = @($Mapping.roleDefinitionId)
85+
}
86+
'accessContainer' = @{
87+
'accessContainerId' = $Mapping.GroupId
88+
}
89+
}
90+
})
91+
$Messages.Add(@{
92+
'id' = $Mapping.GroupId
93+
'message' = "Creating access assignment for $($Mapping.GroupName)"
94+
})
95+
}
96+
}
97+
98+
if ($Requests) {
99+
Write-Warning "Executing $($Requests.Count) access assignment changes"
100+
#Write-Information ($Requests | ConvertTo-Json -Depth 10)
101+
102+
$BulkResults = New-GraphBulkRequest -Requests $Requests -NoAuthCheck $true
103+
$Results = foreach ($Result in $BulkResults) {
104+
$Message = $Messages | Where-Object id -EQ $Result.id
105+
if ($Result.status -eq 204) {
106+
@{
107+
resultText = $Message.message
108+
state = 'success'
109+
}
110+
} else {
111+
@{
112+
resultText = "Error: $($Message.message): $($Result.body.error.message)"
113+
state = 'error'
114+
}
115+
}
116+
}
117+
118+
} else {
119+
$Results = @{
120+
resultText = 'This relationship already has the correct access assignments'
121+
state = 'success'
122+
}
123+
}
124+
125+
$Body = @{
126+
Results = @($Results)
127+
}
128+
}
129+
}
130+
default {
131+
$Body = @{
132+
Results = @(@{
133+
state = 'error'
134+
resultText = 'Invalid action'
135+
})
136+
}
137+
}
138+
}
139+
Push-OutputBinding -Name Response -Value ([HttpResponseContext]@{
140+
StatusCode = [HttpStatusCode]::OK
141+
Body = $Body
142+
})
143+
}

‎Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Tenant/GDAP/Invoke-ExecGDAPInvite.ps1‎

Lines changed: 92 additions & 70 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
using namespace System.Net
2-
Function Invoke-ExecGDAPInvite {
2+
function Invoke-ExecGDAPInvite {
33
<#
44
.FUNCTIONALITY
55
Entrypoint,AnyTenant
@@ -12,89 +12,111 @@ Function Invoke-ExecGDAPInvite {
1212
$APIName = 'ExecGDAPInvite'
1313
Write-LogMessage -headers $Request.Headers -API $APINAME -message 'Accessed this API' -Sev 'Debug'
1414

15-
$RoleMappings = $Request.Body.roleMappings
1615

17-
if ($RoleMappings.roleDefinitionId -contains '62e90394-69f5-4237-9190-012177145e10') {
18-
$AutoExtendDuration = 'PT0S'
19-
} else {
20-
$AutoExtendDuration = 'P180D'
21-
}
16+
$Action = $Request.Body.Action ?? $Request.Query.Action ?? 'Create'
2217

23-
$Table = Get-CIPPTable -TableName 'GDAPInvites'
24-
try {
25-
$Step = 'Creating GDAP relationship'
26-
$JSONBody = @{
27-
'displayName' = "CIPP_$((New-Guid).GUID)"
28-
'accessDetails' = @{
29-
'unifiedRoles' = @($RoleMappings | Select-Object roleDefinitionId)
30-
}
31-
'autoExtendDuration' = $AutoExtendDuration
32-
'duration' = 'P730D'
33-
} | ConvertTo-Json -Depth 5 -Compress
34-
35-
$NewRelationship = New-GraphPostRequest -NoAuthCheck $True -uri 'https://graph.microsoft.com/beta/tenantRelationships/delegatedAdminRelationships' -type POST -body $JSONBody -verbose -tenantid $env:TenantID
36-
Start-Sleep -Milliseconds 100
37-
$Count = 0
38-
do {
39-
$CheckActive = New-GraphGetRequest -NoAuthCheck $True -uri "https://graph.microsoft.com/beta/tenantRelationships/delegatedAdminRelationships/$($NewRelationship.id)" -tenantid $env:TenantID
40-
Start-Sleep -Milliseconds 200
41-
$Count++
42-
} until ($CheckActive.status -eq 'created' -or $Count -gt 5)
43-
44-
if ($CheckActive.status -eq 'created') {
45-
# Lock for approval
46-
$JSONBody = @{
47-
'action' = 'lockForApproval'
48-
} | ConvertTo-Json
49-
$Step = 'Locking GDAP relationship for approval'
50-
51-
$AddedHeaders = @{
52-
'If-Match' = $NewRelationship.'@odata.etag'
18+
switch ($Action) {
19+
'Create' {
20+
$RoleMappings = $Request.Body.roleMappings
21+
22+
if ($RoleMappings.roleDefinitionId -contains '62e90394-69f5-4237-9190-012177145e10') {
23+
$AutoExtendDuration = 'PT0S'
24+
} else {
25+
$AutoExtendDuration = 'P180D'
5326
}
5427

55-
$NewRelationshipRequest = New-GraphPostRequest -NoAuthCheck $True -uri "https://graph.microsoft.com/beta/tenantRelationships/delegatedAdminRelationships/$($NewRelationship.id)/requests" -type POST -body $JSONBody -verbose -tenantid $env:TenantID -AddedHeaders $AddedHeaders
28+
$Table = Get-CIPPTable -TableName 'GDAPInvites'
29+
try {
30+
$Step = 'Creating GDAP relationship'
31+
$JSONBody = @{
32+
'displayName' = "CIPP_$((New-Guid).GUID)"
33+
'accessDetails' = @{
34+
'unifiedRoles' = @($RoleMappings | Select-Object roleDefinitionId)
35+
}
36+
'autoExtendDuration' = $AutoExtendDuration
37+
'duration' = 'P730D'
38+
} | ConvertTo-Json -Depth 5 -Compress
39+
40+
$NewRelationship = New-GraphPostRequest -NoAuthCheck $True -uri 'https://graph.microsoft.com/beta/tenantRelationships/delegatedAdminRelationships' -type POST -body $JSONBody -verbose -tenantid $env:TenantID
41+
Start-Sleep -Milliseconds 100
42+
$Count = 0
43+
do {
44+
$CheckActive = New-GraphGetRequest -NoAuthCheck $True -uri "https://graph.microsoft.com/beta/tenantRelationships/delegatedAdminRelationships/$($NewRelationship.id)" -tenantid $env:TenantID
45+
Start-Sleep -Milliseconds 200
46+
$Count++
47+
} until ($CheckActive.status -eq 'created' -or $Count -gt 5)
48+
49+
if ($CheckActive.status -eq 'created') {
50+
# Lock for approval
51+
$JSONBody = @{
52+
'action' = 'lockForApproval'
53+
} | ConvertTo-Json
54+
$Step = 'Locking GDAP relationship for approval'
55+
56+
$AddedHeaders = @{
57+
'If-Match' = $NewRelationship.'@odata.etag'
58+
}
59+
60+
$NewRelationshipRequest = New-GraphPostRequest -NoAuthCheck $True -uri "https://graph.microsoft.com/beta/tenantRelationships/delegatedAdminRelationships/$($NewRelationship.id)/requests" -type POST -body $JSONBody -verbose -tenantid $env:TenantID -AddedHeaders $AddedHeaders
61+
62+
if ($NewRelationshipRequest.action -eq 'lockForApproval') {
63+
$InviteUrl = "https://admin.microsoft.com/AdminPortal/Home#/partners/invitation/granularAdminRelationships/$($NewRelationship.id)"
64+
try {
65+
$Uri = ([System.Uri]$TriggerMetadata.Headers.Referer)
66+
$OnboardingUrl = $Uri.AbsoluteUri.Replace($Uri.PathAndQuery, "/tenant/gdap-management/onboarding/start?id=$($NewRelationship.id)")
67+
} catch {
68+
$OnboardingUrl = $null
69+
}
5670

57-
if ($NewRelationshipRequest.action -eq 'lockForApproval') {
58-
$InviteUrl = "https://admin.microsoft.com/AdminPortal/Home#/partners/invitation/granularAdminRelationships/$($NewRelationship.id)"
59-
try {
60-
$Uri = ([System.Uri]$TriggerMetadata.Headers.Referer)
61-
$OnboardingUrl = $Uri.AbsoluteUri.Replace($Uri.PathAndQuery, "/tenant/gdap-management/onboarding/start?id=$($NewRelationship.id)")
62-
} catch {
63-
$OnboardingUrl = $null
71+
$InviteEntity = [PSCustomObject]@{
72+
'PartitionKey' = 'invite'
73+
'RowKey' = $NewRelationship.id
74+
'InviteUrl' = $InviteUrl
75+
'OnboardingUrl' = $OnboardingUrl
76+
'RoleMappings' = [string](@($RoleMappings) | ConvertTo-Json -Depth 10 -Compress)
77+
}
78+
Add-CIPPAzDataTableEntity @Table -Entity $InviteEntity
79+
80+
$Message = 'GDAP relationship invite created. Log in as a Global Admin in the new tenant to approve the invite.'
81+
} else {
82+
$Message = 'Error creating GDAP relationship request'
83+
}
84+
85+
Write-LogMessage -headers $Request.Headers -API $APINAME -message "Created GDAP Invite - $InviteUrl" -Sev 'Info'
6486
}
87+
} catch {
88+
$Message = 'Error creating GDAP relationship, failed at step: ' + $Step
89+
Write-Host "GDAP ERROR: $($_.InvocationInfo.PositionMessage)"
6590

66-
$InviteEntity = [PSCustomObject]@{
67-
'PartitionKey' = 'invite'
68-
'RowKey' = $NewRelationship.id
69-
'InviteUrl' = $InviteUrl
70-
'OnboardingUrl' = $OnboardingUrl
71-
'RoleMappings' = [string](@($RoleMappings) | ConvertTo-Json -Depth 10 -Compress)
91+
if ($Step -eq 'Creating GDAP relationship' -and $_.Exception.Message -match 'The user (principal) does not have the required permissions to perform the specified action on the resource.') {
92+
$Message = 'Error creating GDAP relationship, ensure that all users have MFA enabled and enforced without exception. Please see the Microsoft Partner Security Requirements documentation for more information. https://learn.microsoft.com/en-us/partner-center/security/partner-security-requirements'
93+
} else {
94+
$Message = "$($Message): $($_.Exception.Message)"
7295
}
73-
Add-CIPPAzDataTableEntity @Table -Entity $InviteEntity
7496

75-
$Message = 'GDAP relationship invite created. Log in as a Global Admin in the new tenant to approve the invite.'
76-
} else {
77-
$Message = 'Error creating GDAP relationship request'
97+
Write-LogMessage -headers $Request.Headers -API $APINAME -tenant $env:TenantID -message $Message -Sev 'Error' -LogData (Get-CippException -Exception $_)
7898
}
7999

80-
Write-LogMessage -headers $Request.Headers -API $APINAME -message "Created GDAP Invite - $InviteUrl" -Sev 'Info'
100+
$body = @{
101+
Message = $Message
102+
Invite = $InviteEntity
103+
}
81104
}
82-
} catch {
83-
$Message = 'Error creating GDAP relationship, failed at step: ' + $Step
84-
Write-Host "GDAP ERROR: $($_.InvocationInfo.PositionMessage)"
85-
86-
if ($Step -eq 'Creating GDAP relationship' -and $_.Exception.Message -match 'The user (principal) does not have the required permissions to perform the specified action on the resource.') {
87-
$Message = 'Error creating GDAP relationship, ensure that all users have MFA enabled and enforced without exception. Please see the Microsoft Partner Security Requirements documentation for more information. https://learn.microsoft.com/en-us/partner-center/security/partner-security-requirements'
88-
} else {
89-
$Message = "$($Message): $($_.Exception.Message)"
105+
'Delete' {
106+
$InviteId = $Request.Body.InviteId
107+
$Table = Get-CIPPTable -TableName 'GDAPInvites'
108+
$Invite = Get-CIPPAzDataTableEntity @Table -Filter "PartitionKey eq 'invite' and RowKey eq '$InviteId'"
109+
if ($Invite) {
110+
Remove-AzDataTableEntity @Table -Entity $Invite
111+
$Message = 'Invite deleted'
112+
} else {
113+
$Message = 'Invite not found'
114+
}
115+
$body = @{
116+
Message = $Message
117+
}
90118
}
91119

92-
Write-LogMessage -headers $Request.Headers -API $APINAME -tenant $env:TenantID -message $Message -Sev 'Error' -LogData (Get-CippException -Exception $_)
93-
}
94-
95-
$body = @{
96-
Message = $Message
97-
Invite = $InviteEntity
98120
}
99121
Push-OutputBinding -Name Response -Value ([HttpResponseContext]@{
100122
StatusCode = [HttpStatusCode]::OK

‎Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Tenant/GDAP/Invoke-ListGDAPAccessAssignments.ps1‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,10 +18,12 @@ function Invoke-ListGDAPAccessAssignments {
1818
$AccessAssignments = New-GraphGetRequest -Uri "https://graph.microsoft.com/beta/tenantRelationships/delegatedAdminRelationships/$Id/accessAssignments" -tenantid $TenantFilter
1919

2020
# get groups asapp
21-
$Groups = New-GraphGetRequest -Uri "https://graph.microsoft.com/beta/groups?`$top=999&`$select=id,displayName&`$filter=securityEnabled eq true" -tenantid $TenantFilter -asApp $true
21+
$Groups = New-GraphGetRequest -Uri "https://graph.microsoft.com/beta/groups?`$top=999&`$select=id,displayName&`$filter=securityEnabled eq true" -tenantid $TenantFilter -asApp $true -NoAuthCheck $true
22+
2223

2324
# Get all the access containers
2425
$AccessContainers = $AccessAssignments.accessContainer.accessContainerId
26+
Write-Information "Getting access containers for $($AccessContainers -join ',')"
2527

2628
$ContainerMembers = foreach ($AccessContainer in $AccessContainers) {
2729
@{

0 commit comments

Comments
 (0)