Skip to content

Commit bbba735

Browse files
KelvinTegelaarKelvinTegelaar
authored
Merge pull request KelvinTegelaar#1754 from sfaxluke/dev
Bug: Handle array type for conditions.users in Conditional Access Template processing
2 parents 9d2831d + 9666ed8 commit bbba735

File tree

3 files changed

+90
-24
lines changed

3 files changed

+90
-24
lines changed

‎Modules/CIPPCore/Public/Compare-CIPPIntuneObject.ps1‎

Lines changed: 69 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,13 @@ function Compare-CIPPIntuneObject {
5858
[int]$MaxDepth = 20
5959
)
6060

61+
# Check for arrays at the start of every recursive call - this catches arrays at any nesting level
62+
$isObj1Array = $Object1 -is [Array] -or $Object1 -is [System.Collections.IList]
63+
$isObj2Array = $Object2 -is [Array] -or $Object2 -is [System.Collections.IList]
64+
if ($isObj1Array -or $isObj2Array) {
65+
return
66+
}
67+
6168
if ($Depth -ge $MaxDepth) {
6269
$result.Add([PSCustomObject]@{
6370
Property = $PropertyPath
@@ -153,34 +160,78 @@ function Compare-CIPPIntuneObject {
153160
}
154161
}
155162
} elseif ($Object1 -is [PSCustomObject] -or $Object1.PSObject.Properties.Count -gt 0) {
156-
$allPropertyNames = @(
157-
$Object1.PSObject.Properties | Select-Object -ExpandProperty Name
158-
$Object2.PSObject.Properties | Select-Object -ExpandProperty Name
159-
) | Select-Object -Unique
163+
# Skip comparison if either object is an array - arrays can't have custom properties set
164+
$isObj1Array = $Object1 -is [Array] -or $Object1 -is [System.Collections.IList]
165+
$isObj2Array = $Object2 -is [Array] -or $Object2 -is [System.Collections.IList]
166+
if ($isObj1Array -or $isObj2Array) {
167+
return
168+
}
169+
170+
# Safely get property names - ensure objects are not arrays before accessing PSObject.Properties
171+
$allPropertyNames = @()
172+
try {
173+
if (-not ($Object1 -is [Array] -or $Object1 -is [System.Collections.IList])) {
174+
$allPropertyNames += $Object1.PSObject.Properties | Select-Object -ExpandProperty Name
175+
}
176+
if (-not ($Object2 -is [Array] -or $Object2 -is [System.Collections.IList])) {
177+
$allPropertyNames += $Object2.PSObject.Properties | Select-Object -ExpandProperty Name
178+
}
179+
$allPropertyNames = $allPropertyNames | Select-Object -Unique
180+
} catch {
181+
return
182+
}
160183

161184
foreach ($propName in $allPropertyNames) {
162185
if (ShouldSkipProperty -PropertyName $propName) { continue }
163186

164187
$newPath = if ($PropertyPath) { "$PropertyPath.$propName" } else { $propName }
165-
$prop1Exists = $Object1.PSObject.Properties.Name -contains $propName
166-
$prop2Exists = $Object2.PSObject.Properties.Name -contains $propName
188+
# Safely check if properties exist - ensure objects are not arrays
189+
$prop1Exists = $false
190+
$prop2Exists = $false
191+
try {
192+
if (-not ($Object1 -is [Array] -or $Object1 -is [System.Collections.IList])) {
193+
$prop1Exists = $Object1.PSObject.Properties.Name -contains $propName
194+
}
195+
if (-not ($Object2 -is [Array] -or $Object2 -is [System.Collections.IList])) {
196+
$prop2Exists = $Object2.PSObject.Properties.Name -contains $propName
197+
}
198+
} catch {
199+
continue
200+
}
167201

168202
if ($prop1Exists -and $prop2Exists) {
169-
if ($Object1.$propName -and $Object2.$propName) {
170-
Compare-ObjectsRecursively -Object1 $Object1.$propName -Object2 $Object2.$propName -PropertyPath $newPath -Depth ($Depth + 1) -MaxDepth $MaxDepth
203+
try {
204+
# Double-check arrays before accessing properties
205+
if (($Object1 -is [Array] -or $Object1 -is [System.Collections.IList]) -or
206+
($Object2 -is [Array] -or $Object2 -is [System.Collections.IList])) {
207+
continue
208+
}
209+
if ($Object1.$propName -and $Object2.$propName) {
210+
Compare-ObjectsRecursively -Object1 $Object1.$propName -Object2 $Object2.$propName -PropertyPath $newPath -Depth ($Depth + 1) -MaxDepth $MaxDepth
211+
}
212+
} catch {
213+
throw
171214
}
172215
} elseif ($prop1Exists) {
173-
$result.Add([PSCustomObject]@{
174-
Property = $newPath
175-
ExpectedValue = $Object1.$propName
176-
ReceivedValue = ''
177-
})
216+
try {
217+
$result.Add([PSCustomObject]@{
218+
Property = $newPath
219+
ExpectedValue = $Object1.$propName
220+
ReceivedValue = ''
221+
})
222+
} catch {
223+
throw
224+
}
178225
} else {
179-
$result.Add([PSCustomObject]@{
180-
Property = $newPath
181-
ExpectedValue = ''
182-
ReceivedValue = $Object2.$propName
183-
})
226+
try {
227+
$result.Add([PSCustomObject]@{
228+
Property = $newPath
229+
ExpectedValue = ''
230+
ReceivedValue = $Object2.$propName
231+
})
232+
} catch {
233+
throw
234+
}
184235
}
185236
}
186237
} else {

‎Modules/CIPPCore/Public/New-CIPPCATemplate.ps1‎

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,14 @@ function New-CIPPCATemplate {
5656
}
5757

5858
if ($excludelocations) { $JSON.conditions.locations.excludeLocations = $excludelocations }
59-
if ($JSON.conditions.users.includeUsers) {
59+
# Check if conditions.users exists and is a PSCustomObject (not an array) before accessing properties
60+
$hasConditionsUsers = $null -ne $JSON.conditions.users
61+
# Explicitly exclude array types - arrays have properties but we can't set custom properties on them
62+
$isArray = $hasConditionsUsers -and ($JSON.conditions.users -is [Array] -or $JSON.conditions.users -is [System.Collections.IList])
63+
$isPSCustomObject = $hasConditionsUsers -and -not $isArray -and ($JSON.conditions.users -is [PSCustomObject] -or ($JSON.conditions.users.PSObject.Properties.Count -gt 0 -and -not $isArray))
64+
$hasIncludeUsers = $isPSCustomObject -and ($null -ne $JSON.conditions.users.includeUsers)
65+
66+
if ($isPSCustomObject -and $hasIncludeUsers) {
6067
$JSON.conditions.users.includeUsers = @($JSON.conditions.users.includeUsers | ForEach-Object {
6168
$originalID = $_
6269
if ($_ -in 'All', 'None', 'GuestOrExternalUsers') { return $_ }
@@ -65,7 +72,8 @@ function New-CIPPCATemplate {
6572
})
6673
}
6774

68-
if ($JSON.conditions.users.excludeUsers) {
75+
# Use the same type check for other user properties
76+
if ($isPSCustomObject -and $null -ne $JSON.conditions.users.excludeUsers) {
6977
$JSON.conditions.users.excludeUsers = @($JSON.conditions.users.excludeUsers | ForEach-Object {
7078
if ($_ -in 'All', 'None', 'GuestOrExternalUsers') { return $_ }
7179
$originalID = $_
@@ -74,15 +82,15 @@ function New-CIPPCATemplate {
7482
})
7583
}
7684

77-
if ($JSON.conditions.users.includeGroups) {
85+
if ($isPSCustomObject -and $null -ne $JSON.conditions.users.includeGroups) {
7886
$JSON.conditions.users.includeGroups = @($JSON.conditions.users.includeGroups | ForEach-Object {
7987
$originalID = $_
8088
if ($_ -in 'All', 'None', 'GuestOrExternalUsers' -or -not (Test-IsGuid $_)) { return $_ }
8189
$match = $groups | Where-Object { $_.id -eq $originalID }
8290
if ($match) { $match.displayName } else { $originalID }
8391
})
8492
}
85-
if ($JSON.conditions.users.excludeGroups) {
93+
if ($isPSCustomObject -and $null -ne $JSON.conditions.users.excludeGroups) {
8694
$JSON.conditions.users.excludeGroups = @($JSON.conditions.users.excludeGroups | ForEach-Object {
8795
$originalID = $_
8896
if ($_ -in 'All', 'None', 'GuestOrExternalUsers' -or -not (Test-IsGuid $_)) { return $_ }

‎Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardConditionalAccessTemplate.ps1‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -105,8 +105,15 @@ function Invoke-CIPPStandardConditionalAccessTemplate {
105105
Set-CIPPStandardsCompareField -FieldName "standards.ConditionalAccessTemplate.$($Setting.value)" -FieldValue "Policy $($Setting.label) is missing from this tenant." -Tenant $Tenant
106106
}
107107
} else {
108-
$CompareObj = ConvertFrom-Json -ErrorAction SilentlyContinue -InputObject (New-CIPPCATemplate -TenantFilter $tenant -JSON $CheckExististing)
109-
$Compare = Compare-CIPPIntuneObject -ReferenceObject $policy -DifferenceObject $CompareObj
108+
$templateResult = New-CIPPCATemplate -TenantFilter $tenant -JSON $CheckExististing
109+
$CompareObj = ConvertFrom-Json -ErrorAction SilentlyContinue -InputObject $templateResult
110+
try {
111+
$Compare = Compare-CIPPIntuneObject -ReferenceObject $policy -DifferenceObject $CompareObj
112+
} catch {
113+
Write-LogMessage -API 'Standards' -tenant $Tenant -message "Error comparing CA policy: $($_.Exception.Message)" -sev Error
114+
Set-CIPPStandardsCompareField -FieldName "standards.ConditionalAccessTemplate.$($Setting.value)" -FieldValue "Error comparing policy: $($_.Exception.Message)" -Tenant $Tenant
115+
continue
116+
}
110117
if (!$Compare) {
111118
Set-CIPPStandardsCompareField -FieldName "standards.ConditionalAccessTemplate.$($Setting.value)" -FieldValue $true -Tenant $Tenant
112119
} else {

0 commit comments

Comments
 (0)