@@ -16,13 +16,9 @@ function Invoke-ExecJITAdmin {
1616 $TenantFilter = $Request.Body.tenantFilter.value ? $Request.Body.tenantFilter.value : $Request.Body.tenantFilter
1717
1818
19- if ($Request.Body.existingUser.value -match ' ^[a-f0-9]{8}-([a-f0-9]{4}-){3}[a-f0-9]{12}$'
20- $Username = (New-GraphGetRequest - uri " https://graph.microsoft.com/v1.0/users/$ ( $Request.Body.existingUser.value ) " - tenantid $TenantFilter ).userPrincipalName
21- }
22-
2319 $Start = ([System.DateTimeOffset ]::FromUnixTimeSeconds($Request.Body.StartDate )).DateTime.ToLocalTime()
2420 $Expiration = ([System.DateTimeOffset ]::FromUnixTimeSeconds($Request.Body.EndDate )).DateTime.ToLocalTime()
25- $Results = [System.Collections.Generic.List [string ]]::new()
21+ $Results = [System.Collections.Generic.List [object ]]::new()
2622
2723 if ($Request.Body.userAction -eq ' create'
2824 $Domain = $Request.Body.Domain.value ? $Request.Body.Domain.value : $Request.Body.Domain
@@ -39,17 +35,62 @@ function Invoke-ExecJITAdmin {
3935 Reason = $Request.Body.reason
4036 Action = ' Create'
4137 TenantFilter = $TenantFilter
38+ Headers = $Headers
39+ APIName = $APIName
40+ }
41+ try {
42+ $CreateResult = Set-CIPPUserJITAdmin @JITAdmin
43+ } catch {
44+ return ([HttpResponseContext ]@ {
45+ StatusCode = [HttpStatusCode ]::BadRequest
46+ Body = @ {' Results' = @ (" Failed to create JIT Admin user: $ ( $_.Exception.Message ) "
47+ })
4248 }
43- $CreateResult = Set-CIPPUserJITAdmin @JITAdmin
44- Write-LogMessage - Headers $Headers - API $APIName - tenant $TenantFilter - message " Created JIT Admin user: $Username . Reason: $ ( $Request.Body.reason ) . Roles: $ ( $Request.Body.adminRoles.label -join ' , ' ) " - Sev ' Info' - LogData $JITAdmin
45- $Results.Add (" Created User: $Username "
49+ $Results.Add (@ {
50+ resultText = " Created User: $Username "
51+ copyField = $Username
52+ state = ' success'
53+ })
4654 if (! $Request.Body.UseTAP ) {
47- $Results.Add (" Password: $ ( $CreateResult.password ) "
55+ $Results.Add (@ {
56+ resultText = " Password: $ ( $CreateResult.password ) "
57+ copyField = $CreateResult.password
58+ state = ' success'
59+ })
4860 }
4961 $Results.Add (" JIT Admin Expires: $ ( $Expiration ) "
5062 Start-Sleep - Seconds 1
63+ } else {
64+
65+ $Username = $Request.Body.existingUser.value
66+ if ($Username -match ' ^[a-f0-9]{8}-([a-f0-9]{4}-){3}[a-f0-9]{12}$'
67+ Write-Information " Resolving UserPrincipalName from ObjectId: $ ( $Request.Body.existingUser.value ) "
68+ $Username = (New-GraphGetRequest - uri " https://graph.microsoft.com/v1.0/users/$ ( $Request.Body.existingUser.value ) " - tenantid $TenantFilter ).userPrincipalName
69+
70+ # If the resolved username is a guest user, we need to use the id instead of the UPN
71+ if ($Username -clike ' *#EXT#*'
72+ $Username = $Request.Body.existingUser.value
73+ }
74+ }
75+
76+ # Validate we have a username
77+ if ([string ]::IsNullOrWhiteSpace($Username )) {
78+ return [HttpResponseContext ]@ {
79+ StatusCode = [HttpStatusCode ]::BadRequest
80+ Body = @ { ' Results' = @ (" Could not resolve username from existingUser value: $ ( $Request.Body.existingUser.value ) "
81+ }
82+ }
83+
84+ # Add username result for existing user
85+ $Results.Add (@ {
86+ resultText = " User: $Username "
87+ copyField = $Username
88+ state = ' success'
89+ })
5190 }
5291
92+
93+
5394 # Region TAP creation
5495 if ($Request.Body.UseTAP ) {
5596 try {
@@ -82,13 +123,21 @@ function Invoke-ExecJITAdmin {
82123 $PasswordLink = New-PwPushLink - Payload $TempPass
83124 $Password = $PasswordLink ? $PasswordLink : $TempPass
84125
85- $Results.Add (" Temporary Access Pass: $Password "
126+ $Results.Add (@ {
127+ resultText = " Temporary Access Pass: $Password "
128+ copyField = $Password
129+ state = ' success'
130+ })
86131 $Results.Add (" This TAP is usable starting at $ ( $TapRequest.startDateTime ) UTC for the next $PasswordExpiration minutes"
87132 } catch {
88133 $Results.Add (' Failed to create TAP, if this is not yet enabled, use the Standards to push the settings to the tenant.'
89134 Write-Information (Get-CippException - Exception $_ | ConvertTo-Json - Depth 5 )
90135 if ($Password ) {
91- $Results.Add (" Password: $Password "
136+ $Results.Add (@ {
137+ resultText = " Password: $Password "
138+ copyField = $Password
139+ state = ' success'
140+ })
92141 }
93142 }
94143 }
@@ -103,6 +152,8 @@ function Invoke-ExecJITAdmin {
103152 Action = ' AddRoles'
104153 Reason = $Request.Body.Reason
105154 Expiration = $Expiration
155+ Headers = $Headers
156+ APIName = $APIName
106157 }
107158 if ($Start -gt (Get-Date )) {
108159 $TaskBody = @ {
@@ -125,11 +176,16 @@ function Invoke-ExecJITAdmin {
125176 Set-CIPPUserJITAdminProperties - TenantFilter $TenantFilter - UserId $Request.Body.existingUser.value - Expiration $Expiration - Reason $Request.Body.Reason
126177 }
127178 $Results.Add (" Scheduling JIT Admin enable task for $Username "
128- Write-LogMessage - Headers $Headers - API $APIName - message " Scheduling JIT Admin for existing user: $Username . Reason: $ ( $Request.Body.reason ) . Roles: $ ( $Request.Body.adminRoles.label -join ' , ' ) " - tenant $TenantFilter - Sev ' Info'
129179 } else {
130- $Results.Add (" Executing JIT Admin enable task for $Username "
131- Set-CIPPUserJITAdmin @Parameters
132- Write-LogMessage - Headers $Headers - API $APIName - message " Executing JIT Admin for existing user: $Username . Reason: $ ( $Request.Body.reason ) . Roles: $ ( $Request.Body.adminRoles.label -join ' , ' ) " - tenant $TenantFilter - Sev ' Info'
180+ try {
181+ $Results.Add (" Executing JIT Admin enable task for $Username "
182+ Set-CIPPUserJITAdmin @Parameters
183+ } catch {
184+ return ([HttpResponseContext ]@ {
185+ StatusCode = [HttpStatusCode ]::BadRequest
186+ Body = @ {' Results' = @ (" Failed to execute JIT Admin enable task: $ ( $_.Exception.Message ) "
187+ })
188+ }
133189 }
134190
135191 $DisableTaskBody = [pscustomobject ]@ {
@@ -158,7 +214,6 @@ function Invoke-ExecJITAdmin {
158214 $null = Add-CIPPScheduledTask - Task $DisableTaskBody - hidden $false
159215 $Results.Add (" Scheduling JIT Admin $ ( $Request.Body.ExpireAction.value ) task for $Username "
160216
161- # TODO - We should find a way to have this return a HTTP status code based on the success or failure of the operation. This also doesn't return the results of the operation in a Results hash table, like most of the rest of the API.
162217 return ([HttpResponseContext ]@ {
163218 StatusCode = [HttpStatusCode ]::OK
164219 Body = @ {' Results' = @ ($Results ) }
0 commit comments