Skip to content

Commit 73f590a

Browse files
pull[bot]pull[bot]
authored
Merge pull request #630 from KelvinTegelaar/dev
[pull] dev from KelvinTegelaar:dev
2 parents 07a61cb + e2be69c commit 73f590a

File tree

9 files changed

+100
-78
lines changed

9 files changed

+100
-78
lines changed

‎Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Tenant/Conditional/Invoke-ExecCAServiceExclusion.ps1‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
Function Invoke-ExecCAServiceExclusion {
1+
function Invoke-ExecCAServiceExclusion {
22
<#
33
.FUNCTIONALITY
44
Entrypoint
@@ -17,15 +17,15 @@ Function Invoke-ExecCAServiceExclusion {
1717
try {
1818
$result = Set-CIPPCAPolicyServiceException -TenantFilter $TenantFilter -PolicyId $ID
1919
$Body = @{ Results = $result }
20-
Write-LogMessage -headers $Headers -API 'Set-CIPPCAPolicyServiceException' -message $Message -Sev 'Info' -tenant $TenantFilter
20+
Write-LogMessage -headers $Headers -API 'Set-CIPPCAPolicyServiceException' -message $result -Sev 'Info' -tenant $TenantFilter
2121
} catch {
2222
$ErrorMessage = Get-CippException -Exception $_
2323
$Body = @{ Results = "Failed to add service provider exception to policy $($ID): $($ErrorMessage.NormalizedError)" }
2424
Write-LogMessage -headers $Headers -API 'Set-CIPPCAPolicyServiceException' -message "Failed to update policy $($PolicyId) with service provider exception for tenant $($CSPtenantId): $($_.Exception.Message)" -Sev 'Error' -tenant $TenantFilter -LogData (Get-CippException -Exception $_)
2525
}
2626

2727
return ([HttpResponseContext]@{
28-
StatusCode = [HttpStatusCode]::OK
29-
Body = $Body
30-
})
28+
StatusCode = [HttpStatusCode]::OK
29+
Body = $Body
30+
})
3131
}

‎Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Tools/GitHub/Invoke-ListCommunityRepos.ps1‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ function Invoke-ListCommunityRepos {
4242
WriteAccess = $Repo.WriteAccess
4343
DefaultBranch = $Repo.DefaultBranch
4444
UploadBranch = $Repo.DefaultBranch
45-
Permissions = [string]($Repo.RepoPermissions | ConvertTo-Json)
45+
Permissions = [string]($Repo.RepoPermissions | ConvertTo-Json -ErrorAction SilentlyContinue -Compress)
4646
}
4747
Add-CIPPAzDataTableEntity @Table -Entity $Entity
4848
$DefaultsMissing = $true
@@ -65,7 +65,7 @@ function Invoke-ListCommunityRepos {
6565
WriteAccess = $_.WriteAccess
6666
DefaultBranch = $_.DefaultBranch
6767
UploadBranch = $_.UploadBranch ?? $_.DefaultBranch
68-
RepoPermissions = $_.Permissions | ConvertFrom-Json
68+
RepoPermissions = ($_.Permissions | ConvertFrom-Json -ErrorAction SilentlyContinue) ?? @{}
6969
}
7070
}
7171

‎Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Tools/GitHub/Invoke-ListGitHubReleaseNotes.ps1‎

Lines changed: 24 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -29,12 +29,34 @@
2929
$Table = Get-CIPPTable -TableName cacheGitHubReleaseNotes
3030
$PartitionKey = 'GitHubReleaseNotes'
3131
$Filter = "PartitionKey eq '$PartitionKey'"
32-
$Rows = Get-CIPPAzDataTableEntity @Table -filter $Filter | Where-Object -Property Timestamp -GT (Get-Date).AddHours(-24)
32+
$Rows = Get-CIPPAzDataTableEntity @Table -filter $Filter
3333

3434
try {
35+
$Latest = $false
3536
if ($Rows) {
3637
$Releases = ConvertFrom-Json -InputObject $Rows.GitHubReleases -Depth 10
37-
} else {
38+
$CurrentVersion = [semver]$global:CippVersion
39+
$CurrentMajorMinor = "$($CurrentVersion.Major).$($CurrentVersion.Minor)"
40+
41+
foreach ($Release in $Releases) {
42+
$Version = $Release.releaseTag -replace 'v', ''
43+
try {
44+
$ReleaseVersion = [semver]$Version
45+
$ReleaseMajorMinor = "$($ReleaseVersion.Major).$($ReleaseVersion.Minor)"
46+
47+
# Check if we have cached notes for the current major.minor version series
48+
if ($ReleaseMajorMinor -eq $CurrentMajorMinor) {
49+
$Latest = $true
50+
break
51+
}
52+
} catch {
53+
# Skip invalid semver versions
54+
continue
55+
}
56+
}
57+
}
58+
59+
if (-not $Latest) {
3860
$Releases = Invoke-GitHubApiRequest -Path $ReleasePath
3961
$Releases = $Releases | ForEach-Object {
4062
[ordered]@{
@@ -48,7 +70,6 @@
4870
commitish = $_.target_commitish
4971
}
5072
}
51-
5273
$Results = @{
5374
GitHubReleases = [string](ConvertTo-Json -Depth 10 -InputObject $Releases)
5475
RowKey = [string]'GitHubReleaseNotes'

‎Modules/CIPPCore/Public/New-CIPPCAPolicy.ps1‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -204,6 +204,7 @@ function New-CIPPCAPolicy {
204204
Write-Information ($LocationLookupTable | ConvertTo-Json -Depth 10)
205205

206206
foreach ($location in $JSONobj.conditions.locations.includeLocations) {
207+
if ($null -eq $location) { continue }
207208
$lookup = $LocationLookupTable | Where-Object { $_.name -eq $location -or $_.displayName -eq $location -or $_.templateId -eq $location }
208209
if (!$lookup) { continue }
209210
Write-Information "Replacing named location - $location"
@@ -212,6 +213,7 @@ function New-CIPPCAPolicy {
212213
}
213214

214215
foreach ($location in $JSONobj.conditions.locations.excludeLocations) {
216+
if ($null -eq $location) { continue }
215217
$lookup = $LocationLookupTable | Where-Object { $_.name -eq $location -or $_.displayName -eq $location -or $_.templateId -eq $location }
216218
if (!$lookup) { continue }
217219
Write-Information "Replacing named location - $location"

‎Modules/CIPPCore/Public/New-CIPPCATemplate.ps1‎

Lines changed: 36 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,15 @@ function New-CIPPCATemplate {
1313
$NonEmptyProperties = $_.psobject.Properties | Where-Object { $null -ne $_.Value } | Select-Object -ExpandProperty Name
1414
$_ | Select-Object -Property $NonEmptyProperties
1515
}
16+
17+
Write-Information "Processing CA Template for tenant $TenantFilter"
18+
Write-Information ($JSON | ConvertTo-Json -Depth 10)
19+
20+
# Function to check if a string is a GUID
21+
function Test-IsGuid($string) {
22+
return [guid]::tryparse($string, [ref][guid]::Empty)
23+
}
24+
1625
if ($preloadedUsers) {
1726
$users = $preloadedUsers
1827
} else {
@@ -23,18 +32,25 @@ function New-CIPPCATemplate {
2332
} else {
2433
$groups = (New-GraphGetRequest -uri "https://graph.microsoft.com/beta/groups?`$top=999&`$select=displayName,id" -tenantid $TenantFilter)
2534
}
26-
$includelocations = New-Object System.Collections.ArrayList
35+
36+
$namedLocations = $null
37+
if ($JSON.conditions.locations.includeLocations -or $JSON.conditions.locations.excludeLocations) {
38+
$namedLocations = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/identity/conditionalAccess/namedLocations' -tenantid $TenantFilter
39+
}
40+
41+
$AllLocations = [system.collections.generic.list[object]]::new()
42+
43+
$includelocations = [system.collections.generic.list[object]]::new()
2744
$IncludeJSON = foreach ($Location in $JSON.conditions.locations.includeLocations) {
28-
$locationinfo = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/identity/conditionalAccess/namedLocations' -tenantid $TenantFilter | Where-Object -Property id -EQ $location | Select-Object * -ExcludeProperty id, *time*
45+
$locationinfo = $namedLocations | Where-Object -Property id -EQ $location | Select-Object * -ExcludeProperty id, *time*
2946
$null = if ($locationinfo) { $includelocations.add($locationinfo.displayName) } else { $includelocations.add($location) }
3047
$locationinfo
3148
}
3249
if ($includelocations) { $JSON.conditions.locations.includeLocations = $includelocations }
3350

34-
35-
$excludelocations = New-Object System.Collections.ArrayList
51+
$excludelocations = [system.collections.generic.list[object]]::new()
3652
$ExcludeJSON = foreach ($Location in $JSON.conditions.locations.excludeLocations) {
37-
$locationinfo = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/identity/conditionalAccess/namedLocations' -tenantid $TenantFilter | Where-Object -Property id -EQ $location | Select-Object * -ExcludeProperty id, *time*
53+
$locationinfo = $namedLocations | Where-Object -Property id -EQ $location | Select-Object * -ExcludeProperty id, *time*
3854
$null = if ($locationinfo) { $excludelocations.add($locationinfo.displayName) } else { $excludelocations.add($location) }
3955
$locationinfo
4056
}
@@ -44,59 +60,45 @@ function New-CIPPCATemplate {
4460
$JSON.conditions.users.includeUsers = @($JSON.conditions.users.includeUsers | ForEach-Object {
4561
$originalID = $_
4662
if ($_ -in 'All', 'None', 'GuestOrExternalUsers') { return $_ }
47-
try {
48-
($users | Where-Object { $_.id -eq $_ }).displayName
49-
} catch {
50-
return $originalID
51-
}
63+
$match = $users | Where-Object { $_.id -eq $originalID }
64+
if ($match) { $match.displayName } else { $originalID }
5265
})
5366
}
5467

5568
if ($JSON.conditions.users.excludeUsers) {
5669
$JSON.conditions.users.excludeUsers = @($JSON.conditions.users.excludeUsers | ForEach-Object {
5770
if ($_ -in 'All', 'None', 'GuestOrExternalUsers') { return $_ }
5871
$originalID = $_
59-
60-
try {
61-
($users | Where-Object { $_.id -eq $_ }).displayName
62-
} catch {
63-
return $originalID
64-
}
72+
$match = $users | Where-Object { $_.id -eq $originalID }
73+
if ($match) { $match.displayName } else { $originalID }
6574
})
6675
}
6776

68-
# Function to check if a string is a GUID
69-
function Test-IsGuid($string) {
70-
return [guid]::tryparse($string, [ref][guid]::Empty)
71-
}
72-
7377
if ($JSON.conditions.users.includeGroups) {
7478
$JSON.conditions.users.includeGroups = @($JSON.conditions.users.includeGroups | ForEach-Object {
7579
$originalID = $_
7680
if ($_ -in 'All', 'None', 'GuestOrExternalUsers' -or -not (Test-IsGuid $_)) { return $_ }
77-
try {
78-
($groups | Where-Object { $_.id -eq $_ }).displayName
79-
} catch {
80-
return $originalID
81-
}
81+
$match = $groups | Where-Object { $_.id -eq $originalID }
82+
if ($match) { $match.displayName } else { $originalID }
8283
})
8384
}
8485
if ($JSON.conditions.users.excludeGroups) {
8586
$JSON.conditions.users.excludeGroups = @($JSON.conditions.users.excludeGroups | ForEach-Object {
8687
$originalID = $_
87-
8888
if ($_ -in 'All', 'None', 'GuestOrExternalUsers' -or -not (Test-IsGuid $_)) { return $_ }
89-
try {
90-
($groups | Where-Object { $_.id -eq $_ }).displayName
91-
} catch {
92-
return $originalID
93-
94-
}
89+
$match = $groups | Where-Object { $_.id -eq $originalID }
90+
if ($match) { $match.displayName } else { $originalID }
9591
})
9692
}
9793

98-
$JSON | Add-Member -NotePropertyName 'LocationInfo' -NotePropertyValue @($IncludeJSON, $ExcludeJSON)
94+
foreach ($Location in $IncludeJSON) {
95+
$AllLocations.Add($Location)
96+
}
97+
foreach ($Location in $ExcludeJSON) {
98+
$AllLocations.Add($Location)
99+
}
99100

101+
$JSON | Add-Member -NotePropertyName 'LocationInfo' -NotePropertyValue @($AllLocations | Select-Object -Unique) -Force
100102
$JSON = (ConvertTo-Json -Compress -Depth 100 -InputObject $JSON)
101103
return $JSON
102104
}

‎Modules/CIPPCore/Public/Set-CIPPCAPolicyServiceException.ps1‎

Lines changed: 24 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -11,20 +11,20 @@ function Set-CIPPCAPolicyServiceException {
1111
$policy = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/identity/conditionalAccess/policies/$($PolicyId)" -tenantid $TenantFilter -AsApp $true
1212

1313
# If the policy is set to affect either all or all guests/external users
14-
if ($policy.conditions.users.includeUsers -eq "All" -OR $policy.conditions.users.includeGuestsOrExternalUsers.externalTenants.membershipKind -eq "all") {
14+
if ($policy.conditions.users.includeUsers -eq 'All' -or $policy.conditions.users.includeGuestsOrExternalUsers.externalTenants.membershipKind -eq 'all') {
1515

1616
# Check if the policy already has the correct service provider exception
1717
if ($policy.conditions.users.excludeGuestsOrExternalUsers) {
1818
$excludeConfig = $policy.conditions.users.excludeGuestsOrExternalUsers
1919

2020
# Check if serviceProvider is already in guestOrExternalUserTypes
21-
$hasServiceProvider = $excludeConfig.guestOrExternalUserTypes -match "serviceProvider"
21+
$hasServiceProvider = $excludeConfig.guestOrExternalUserTypes -match 'serviceProvider'
2222

2323
# Check if externalTenants is properly configured
2424
if ($excludeConfig.externalTenants) {
2525
$externalTenants = $excludeConfig.externalTenants
26-
$hasCorrectExternalTenants = ($externalTenants.membershipKind -eq "enumerated" -and
27-
$externalTenants.members -contains $CSPtenantId)
26+
$hasCorrectExternalTenants = ($externalTenants.membershipKind -eq 'enumerated' -and
27+
$externalTenants.members -contains $CSPtenantId)
2828

2929
# If already configured, exit without making changes
3030
if ($hasServiceProvider -and $hasCorrectExternalTenants) {
@@ -38,11 +38,11 @@ function Set-CIPPCAPolicyServiceException {
3838

3939
# Define data
4040
$excludeServiceProviderData = [pscustomobject]@{
41-
guestOrExternalUserTypes = "serviceProvider"
42-
externalTenants = [pscustomobject]@{
43-
'@odata.type' = "#microsoft.graph.conditionalAccessEnumeratedExternalTenants"
44-
membershipKind = "enumerated"
45-
members = @(
41+
guestOrExternalUserTypes = 'serviceProvider'
42+
externalTenants = [pscustomobject]@{
43+
'@odata.type' = '#microsoft.graph.conditionalAccessEnumeratedExternalTenants'
44+
membershipKind = 'enumerated'
45+
members = @(
4646
$CSPtenantId
4747
)
4848
}
@@ -56,27 +56,31 @@ function Set-CIPPCAPolicyServiceException {
5656
if ($policy.conditions.users.excludeGuestsOrExternalUsers) {
5757

5858
# If guestOrExternalUserTypes doesn't include type serviceProvider add it
59-
if ($policy.conditions.users.excludeGuestsOrExternalUsers.guestOrExternalUserTypes -notmatch "serviceProvider") {
60-
$policy.conditions.users.excludeGuestsOrExternalUsers.guestOrExternalUserTypes += ",serviceProvider"
59+
if ($policy.conditions.users.excludeGuestsOrExternalUsers.guestOrExternalUserTypes -notmatch 'serviceProvider') {
60+
$policy.conditions.users.excludeGuestsOrExternalUsers.guestOrExternalUserTypes += ',serviceProvider'
6161
}
6262

6363
# If guestOrExternalUserTypes includes type serviceProvider and membershipKind is not all tenants
64-
if ($policy.conditions.users.excludeGuestsOrExternalUsers.guestOrExternalUserTypes -match "serviceProvider" -AND $policy.conditions.users.excludeGuestsOrExternalUsers.externalTenants.membershipKind -ne "all") {
64+
if ($policy.conditions.users.excludeGuestsOrExternalUsers.guestOrExternalUserTypes -match 'serviceProvider' -and $policy.conditions.users.excludeGuestsOrExternalUsers.externalTenants.membershipKind -ne 'all') {
6565

6666
# If membershipKind is enumerated and members does not include our tenant add it
67-
if ($policy.conditions.users.excludeGuestsOrExternalUsers.externalTenants.membershipKind -eq "enumerated" -AND $policy.conditions.users.excludeGuestsOrExternalUsers.externalTenants.members -notmatch $CSPtenantId) {
67+
if ($policy.conditions.users.excludeGuestsOrExternalUsers.externalTenants.membershipKind -eq 'enumerated' -and $policy.conditions.users.excludeGuestsOrExternalUsers.externalTenants.members -notmatch $CSPtenantId) {
6868
$policy.conditions.users.excludeGuestsOrExternalUsers.externalTenants.members += $($CSPtenantId)
6969
}
7070
}
7171
}
72+
$Json = $policy | Select-Object * -ExcludeProperty TemplateId, createdDateTime, modifiedDateTime | ConvertTo-Json -Depth 20
7273

73-
}
74+
Write-Information 'Updated policy JSON:'
75+
Write-Information $Json
7476

75-
# Patch policy with updated data.
76-
# TemplateId,createdDateTime,modifiedDateTime can't be written back so exclude them using -ExcludeProperty
77-
if ($PSCmdlet.ShouldProcess($PolicyId, "Update policy with service provider exception")) {
78-
$patch = New-GraphPOSTRequest -uri "https://graph.microsoft.com/beta/identity/conditionalAccess/policies/$($policy.id)" -tenantid $TenantFilter -type PATCH -body ($policy | Select-Object * -ExcludeProperty TemplateId,createdDateTime,modifiedDateTime | ConvertTo-Json -Depth 20) -AsApp $true
79-
return "Successfully added service provider to policy $PolicyId"
77+
# Patch policy with updated data.
78+
# TemplateId,createdDateTime,modifiedDateTime can't be written back so exclude them using -ExcludeProperty
79+
if ($PSCmdlet.ShouldProcess($PolicyId, 'Update policy with service provider exception')) {
80+
$patch = New-GraphPOSTRequest -uri "https://graph.microsoft.com/beta/identity/conditionalAccess/policies/$($policy.id)" -tenantid $TenantFilter -type PATCH -body ($policy | Select-Object * -ExcludeProperty TemplateId, createdDateTime, modifiedDateTime | ConvertTo-Json -Depth 20) -AsApp $true
81+
return "Successfully added service provider to policy $PolicyId"
82+
}
83+
} else {
84+
return "Policy $PolicyId does not target all users or all guest/external users. No changes made."
8085
}
81-
8286
}

‎Modules/CIPPCore/Public/Webhooks/Test-CIPPAuditLogRules.ps1‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -176,10 +176,10 @@ function Test-CIPPAuditLogRules {
176176
}
177177
)
178178
$Response = New-GraphBulkRequest -TenantId $TenantFilter -Requests $Requests
179-
$Users = ($Response | Where-Object { $_.id -eq 'users' }).body.value
179+
$Users = ($Response | Where-Object { $_.id -eq 'users' }).body.value ?? @()
180180
$Groups = ($Response | Where-Object { $_.id -eq 'groups' }).body.value ?? @()
181181
$Devices = ($Response | Where-Object { $_.id -eq 'devices' }).body.value ?? @()
182-
$ServicePrincipals = ($Response | Where-Object { $_.id -eq 'servicePrincipals' }).body.value
182+
$ServicePrincipals = ($Response | Where-Object { $_.id -eq 'servicePrincipals' }).body.value ?? @()
183183
# Cache the lookups for 1 day
184184
$Entities = @(
185185
@{
@@ -208,10 +208,10 @@ function Test-CIPPAuditLogRules {
208208
Write-Information "Cached directory lookups for tenant $TenantFilter"
209209
} else {
210210
# Use cached lookups
211-
$Users = ($Lookups | Where-Object { $_.RowKey -eq 'users' }).Data | ConvertFrom-Json
211+
$Users = (($Lookups | Where-Object { $_.RowKey -eq 'users' }).Data | ConvertFrom-Json -ErrorAction SilentlyContinue) ?? @()
212212
$Groups = (($Lookups | Where-Object { $_.RowKey -eq 'groups' }).Data | ConvertFrom-Json -ErrorAction SilentlyContinue) ?? @()
213213
$Devices = (($Lookups | Where-Object { $_.RowKey -eq 'devices' }).Data | ConvertFrom-Json -ErrorAction SilentlyContinue) ?? @()
214-
$ServicePrincipals = ($Lookups | Where-Object { $_.RowKey -eq 'servicePrincipals' }).Data | ConvertFrom-Json
214+
$ServicePrincipals = (($Lookups | Where-Object { $_.RowKey -eq 'servicePrincipals' }).Data | ConvertFrom-Json -ErrorAction SilentlyContinue) ?? @()
215215
Write-Information "Using cached directory lookups for tenant $TenantFilter"
216216
}
217217

‎host.json‎

Lines changed: 2 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -8,13 +8,6 @@
88
"version": "[4.26.0, 5.0.0)"
99
},
1010
"functionTimeout": "00:10:00",
11-
12-
"logging": {
13-
"console": {
14-
"isEnabled": true,
15-
"enableStructuredLogging": true
16-
}
17-
},
1811
"extensions": {
1912
"durableTask": {
2013
"maxConcurrentActivityFunctions": 1,
@@ -23,9 +16,9 @@
2316
"distributedTracingEnabled": false,
2417
"version": "None"
2518
},
26-
"defaultVersion": "8.8.0",
19+
"defaultVersion": "8.8.1",
2720
"versionMatchStrategy": "Strict",
2821
"versionFailureStrategy": "Fail"
2922
}
3023
}
31-
}
24+
}

‎version_latest.txt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
8.8.0
1+
8.8.1

0 commit comments

Comments
 (0)