Merge pull request #1065 from JohnDuprey/dev

CIPP-SAM permissions and fixes
KelvinTegelaar · Aug 14, 2024 · 63aeef5 · 63aeef5
2 parents 04c71ac + 5f57b5b
commit 63aeef5
Show file tree

Hide file tree

Showing 4 changed files with 173 additions and 3 deletions.
diff --git a/Modules/CIPPCore/Public/Entrypoints/Activity Triggers/Webhooks/Push-AuditLogTenant.ps1 b/Modules/CIPPCore/Public/Entrypoints/Activity Triggers/Webhooks/Push-AuditLogTenant.ps1
@@ -3,9 +3,9 @@ function Push-AuditLogTenant {
 
     # Get Table contexts
     $AuditBundleTable = Get-CippTable -tablename 'AuditLogBundles'
-    $SchedulerConfig = Get-CIPPTable -TableName 'SchedulerConfig'
+    $SchedulerConfig = Get-CippTable -TableName 'SchedulerConfig'
     $WebhookTable = Get-CippTable -tablename 'webhookTable'
-    $ConfigTable = Get-CIPPTable -TableName 'WebhookRules'
+    $ConfigTable = Get-CippTable -TableName 'WebhookRules'
 
     # Query CIPPURL for linking
     $CIPPURL = Get-CIPPAzDataTableEntity @SchedulerConfig -Filter "PartitionKey eq 'webhookcreation'" | Select-Object -First 1 -ExpandProperty CIPPURL

diff --git a/...les/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecServicePrincipals.ps1 b/...les/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecServicePrincipals.ps1
@@ -0,0 +1,58 @@
+function Invoke-ExecServicePrincipals {
+    <#
+    .FUNCTIONALITY
+        Entrypoint
+    .ROLE
+        CIPP.Core.ReadWrite
+    #>
+    [CmdletBinding()]
+    param($Request, $TriggerMetadata)
+
+    $TenantFilter = $env:TenantId
+
+    $Success = $true
+
+    $Action = $Request.Query.Action ?? 'Default'
+    try {
+        switch ($Request.Query.Action) {
+            'Create' {
+                $Body = @{
+                    'appId' = $Request.Query.AppId
+                } | ConvertTo-Json -Compress
+                $Results = New-GraphPostRequest -Uri 'https://graph.microsoft.com/beta/servicePrincipals' -tenantid $TenantFilter -type POST -body $Body
+            }
+            default {
+                if ($Request.Query.AppId) {
+                    $Action = 'Get'
+                    $Results = New-GraphGetRequest -Uri "https://graph.microsoft.com/beta/servicePrincipals(appId='$($Request.Query.AppId)')" -tenantid $TenantFilter -NoAuthCheck $true
+                } else {
+                    $Action = 'List'
+                    $Results = New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/servicePrincipals?$top=999&$orderby=displayName&$count=true' -ComplexFilter -tenantid $TenantFilter -NoAuthCheck $true
+                }
+            }
+        }
+    } catch {
+        $Results = $_.Exception.Message
+        $Success = $false
+    }
+
+    $Metadata = @{
+        'Action'  = $Action
+        'Success' = $Success
+    }
+
+    if ($Request.Query.AppId) {
+        $Metadata.AppId = $Request.Query.AppId
+    }
+
+    $Body = @{
+        'Results'  = $Results
+        'Metadata' = $Metadata
+    }
+
+    $Json = $Body | ConvertTo-Json -Depth 10 -Compress
+    Push-OutputBinding -Name Response -Value ([HttpResponseContext]@{
+            StatusCode = [HttpStatusCode]::OK
+            Body       = $Json
+        })
+}
diff --git a/...CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecSAMAppPermissions.ps1 b/...CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecSAMAppPermissions.ps1
@@ -0,0 +1,112 @@
+function Invoke-ExecSAMAppPermissions {
+    <#
+    .FUNCTIONALITY
+        Entrypoint
+    .ROLE
+        CIPP.SuperAdmin.ReadWrite
+    #>
+    [CmdletBinding()]
+    param($Request, $TriggerMetadata)
+
+    switch ($Request.Query.Action) {
+        'Update' {
+            try {
+                $Permissions = $Request.Body.Permissions
+                $Entity = @{
+                    'PartitionKey' = 'CIPP-SAM'
+                    'RowKey'       = 'CIPP-SAM'
+                    'Permissions'  = [string]($Permissions | ConvertTo-Json -Depth 10 -Compress)
+                }
+                $Table = Get-CIPPTable -TableName 'AppPermissions'
+                $null = Add-CIPPAzDataTableEntity @Table -Entity $Entity -Force
+                $Body = @{
+                    'Results' = 'Permissions Updated'
+                }
+            } catch {
+                $Body = @{
+                    'Results' = $_.Exception.Message
+                }
+            }
+        }
+        default {
+            $ModuleBase = Get-Module -Name CIPPCore | Select-Object -ExpandProperty ModuleBase
+            $SamManifest = Get-Item "$ModuleBase\Public\SAMManifest.json"
+            $AdditionalPermissions = Get-Item "$ModuleBase\Public\AdditionalPermissions.json"
+
+            $LastWrite = @{
+                'SAMManifest'           = $SamManifest.LastWriteTime
+                'AdditionalPermissions' = $AdditionalPermissions.LastWriteTime
+            }
+
+            $ServicePrincipals = New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/servicePrincipals?$top=999&$select=appId,displayName,appRoles,publishedPermissionScopes' -tenantid $env:TenantID -NoAuthCheck $true
+            $SAMManifest = Get-Content -Path $SamManifest.FullName | ConvertFrom-Json
+            $AdditionalPermissions = Get-Content -Path $AdditionalPermissions.FullName | ConvertFrom-Json
+
+            $RequiredResources = $SamManifest.requiredResourceAccess
+
+            $AppIds = ($RequiredResources.resourceAppId + $AdditionalPermissions.resourceAppId) | Sort-Object -Unique
+
+            $Permissions = @{}
+            foreach ($AppId in $AppIds) {
+                $ServicePrincipal = $ServicePrincipals | Where-Object -Property appId -EQ $AppId
+                $AppPermissions = [System.Collections.Generic.List[object]]@()
+                $ManifestPermissions = ($RequiredResources | Where-Object -Property resourceAppId -EQ $AppId).resourceAccess
+                $UnpublishedPermissions = ($AdditionalPermissions | Where-Object -Property resourceAppId -EQ $AppId).resourceAccess
+
+                foreach ($Permission in $ManifestPermissions) {
+                    $AppPermissions.Add($Permission)
+                }
+                if ($UnpublishedPermissions) {
+                    foreach ($Permission in $UnpublishedPermissions) {
+                        $AppPermissions.Add($Permission)
+                    }
+                }
+
+                $ApplicationPermissions = [system.collections.generic.list[object]]@()
+                $DelegatedPermissions = [system.collections.generic.list[object]]@()
+                foreach ($Permission in $AppPermissions) {
+                    if ($Permission.id -match '^[a-f0-9]{8}-([a-f0-9]{4}-){3}[a-f0-9]{12}$') {
+                        if ($Permission.type -eq 'Role') {
+                            $PermissionName = ($ServicePrincipal.appRoles | Where-Object -Property id -EQ $Permission.id).value
+                        } else {
+                            $PermissionName = ($ServicePrincipal.publishedPermissionScopes | Where-Object -Property id -EQ $Permission.id).value
+                        }
+                    } else {
+                        $PermissionName = $Permission.id
+                    }
+
+                    if ($Permission.type -eq 'Role') {
+                        $ApplicationPermissions.Add([PSCustomObject]@{
+                                id    = $Permission.id
+                                value = $PermissionName
+
+                            })
+                    } else {
+                        $DelegatedPermissions.Add([PSCustomObject]@{
+                                id    = $Permission.id
+                                value = $PermissionName
+                            })
+                    }
+                }
+
+                $ServicePrincipal = $ServicePrincipals | Where-Object -Property appId -EQ $AppId
+                $Permissions.$AppId = @{
+                    applicationPermissions = @($ApplicationPermissions | Sort-Object -Property label)
+                    delegatedPermissions   = @($DelegatedPermissions | Sort-Object -Property label)
+                }
+            }
+
+            $Body = @{
+                'Permissions' = $Permissions
+                'LastUpdate'  = $LastWrite
+            }
+        }
+    }
+
+
+    Push-OutputBinding -Name Response -Value ([HttpResponseContext]@{
+            StatusCode = [HttpStatusCode]::OK
+            Body       = ConvertTo-Json -Depth 10 -InputObject $Body
+        })
+
+}
diff --git a/Modules/CIPPCore/Public/Entrypoints/Invoke-ExecListAppId.ps1 b/Modules/CIPPCore/Public/Entrypoints/Invoke-ExecListAppId.ps1
@@ -9,7 +9,7 @@ Function Invoke-ExecListAppId {
     #>
     [CmdletBinding()]
     param($Request, $TriggerMetadata)
-
+    Get-CIPPAuthentication
     $APIName = $TriggerMetadata.FunctionName
     Write-LogMessage -user $request.headers.'x-ms-client-principal' -API $APINAME -message 'Accessed this API' -Sev 'Debug'
     $ResponseURL = "$(($Request.headers.'x-ms-original-url').replace('/api/ExecListAppId','/api/ExecSAMSetup'))"