Skip to content

Commit cb0250f

Browse files
JohnDupreyJohnDuprey
committed
add delete invite
1 parent 2416985 commit cb0250f

File tree

1 file changed

+92
-70
lines changed

1 file changed

+92
-70
lines changed

‎Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Tenant/GDAP/Invoke-ExecGDAPInvite.ps1

Lines changed: 92 additions & 70 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
using namespace System.Net
2-
Function Invoke-ExecGDAPInvite {
2+
function Invoke-ExecGDAPInvite {
33
<#
44
.FUNCTIONALITY
55
Entrypoint,AnyTenant
@@ -12,89 +12,111 @@ Function Invoke-ExecGDAPInvite {
1212
$APIName = 'ExecGDAPInvite'
1313
Write-LogMessage -headers $Request.Headers -API $APINAME -message 'Accessed this API' -Sev 'Debug'
1414

15-
$RoleMappings = $Request.Body.roleMappings
1615

17-
if ($RoleMappings.roleDefinitionId -contains '62e90394-69f5-4237-9190-012177145e10') {
18-
$AutoExtendDuration = 'PT0S'
19-
} else {
20-
$AutoExtendDuration = 'P180D'
21-
}
16+
$Action = $Request.Body.Action ?? $Request.Query.Action ?? 'Create'
2217

23-
$Table = Get-CIPPTable -TableName 'GDAPInvites'
24-
try {
25-
$Step = 'Creating GDAP relationship'
26-
$JSONBody = @{
27-
'displayName' = "CIPP_$((New-Guid).GUID)"
28-
'accessDetails' = @{
29-
'unifiedRoles' = @($RoleMappings | Select-Object roleDefinitionId)
30-
}
31-
'autoExtendDuration' = $AutoExtendDuration
32-
'duration' = 'P730D'
33-
} | ConvertTo-Json -Depth 5 -Compress
34-
35-
$NewRelationship = New-GraphPostRequest -NoAuthCheck $True -uri 'https://graph.microsoft.com/beta/tenantRelationships/delegatedAdminRelationships' -type POST -body $JSONBody -verbose -tenantid $env:TenantID
36-
Start-Sleep -Milliseconds 100
37-
$Count = 0
38-
do {
39-
$CheckActive = New-GraphGetRequest -NoAuthCheck $True -uri "https://graph.microsoft.com/beta/tenantRelationships/delegatedAdminRelationships/$($NewRelationship.id)" -tenantid $env:TenantID
40-
Start-Sleep -Milliseconds 200
41-
$Count++
42-
} until ($CheckActive.status -eq 'created' -or $Count -gt 5)
43-
44-
if ($CheckActive.status -eq 'created') {
45-
# Lock for approval
46-
$JSONBody = @{
47-
'action' = 'lockForApproval'
48-
} | ConvertTo-Json
49-
$Step = 'Locking GDAP relationship for approval'
50-
51-
$AddedHeaders = @{
52-
'If-Match' = $NewRelationship.'@odata.etag'
18+
switch ($Action) {
19+
'Create' {
20+
$RoleMappings = $Request.Body.roleMappings
21+
22+
if ($RoleMappings.roleDefinitionId -contains '62e90394-69f5-4237-9190-012177145e10') {
23+
$AutoExtendDuration = 'PT0S'
24+
} else {
25+
$AutoExtendDuration = 'P180D'
5326
}
5427

55-
$NewRelationshipRequest = New-GraphPostRequest -NoAuthCheck $True -uri "https://graph.microsoft.com/beta/tenantRelationships/delegatedAdminRelationships/$($NewRelationship.id)/requests" -type POST -body $JSONBody -verbose -tenantid $env:TenantID -AddedHeaders $AddedHeaders
28+
$Table = Get-CIPPTable -TableName 'GDAPInvites'
29+
try {
30+
$Step = 'Creating GDAP relationship'
31+
$JSONBody = @{
32+
'displayName' = "CIPP_$((New-Guid).GUID)"
33+
'accessDetails' = @{
34+
'unifiedRoles' = @($RoleMappings | Select-Object roleDefinitionId)
35+
}
36+
'autoExtendDuration' = $AutoExtendDuration
37+
'duration' = 'P730D'
38+
} | ConvertTo-Json -Depth 5 -Compress
39+
40+
$NewRelationship = New-GraphPostRequest -NoAuthCheck $True -uri 'https://graph.microsoft.com/beta/tenantRelationships/delegatedAdminRelationships' -type POST -body $JSONBody -verbose -tenantid $env:TenantID
41+
Start-Sleep -Milliseconds 100
42+
$Count = 0
43+
do {
44+
$CheckActive = New-GraphGetRequest -NoAuthCheck $True -uri "https://graph.microsoft.com/beta/tenantRelationships/delegatedAdminRelationships/$($NewRelationship.id)" -tenantid $env:TenantID
45+
Start-Sleep -Milliseconds 200
46+
$Count++
47+
} until ($CheckActive.status -eq 'created' -or $Count -gt 5)
48+
49+
if ($CheckActive.status -eq 'created') {
50+
# Lock for approval
51+
$JSONBody = @{
52+
'action' = 'lockForApproval'
53+
} | ConvertTo-Json
54+
$Step = 'Locking GDAP relationship for approval'
55+
56+
$AddedHeaders = @{
57+
'If-Match' = $NewRelationship.'@odata.etag'
58+
}
59+
60+
$NewRelationshipRequest = New-GraphPostRequest -NoAuthCheck $True -uri "https://graph.microsoft.com/beta/tenantRelationships/delegatedAdminRelationships/$($NewRelationship.id)/requests" -type POST -body $JSONBody -verbose -tenantid $env:TenantID -AddedHeaders $AddedHeaders
61+
62+
if ($NewRelationshipRequest.action -eq 'lockForApproval') {
63+
$InviteUrl = "https://admin.microsoft.com/AdminPortal/Home#/partners/invitation/granularAdminRelationships/$($NewRelationship.id)"
64+
try {
65+
$Uri = ([System.Uri]$TriggerMetadata.Headers.Referer)
66+
$OnboardingUrl = $Uri.AbsoluteUri.Replace($Uri.PathAndQuery, "/tenant/gdap-management/onboarding/start?id=$($NewRelationship.id)")
67+
} catch {
68+
$OnboardingUrl = $null
69+
}
5670

57-
if ($NewRelationshipRequest.action -eq 'lockForApproval') {
58-
$InviteUrl = "https://admin.microsoft.com/AdminPortal/Home#/partners/invitation/granularAdminRelationships/$($NewRelationship.id)"
59-
try {
60-
$Uri = ([System.Uri]$TriggerMetadata.Headers.Referer)
61-
$OnboardingUrl = $Uri.AbsoluteUri.Replace($Uri.PathAndQuery, "/tenant/gdap-management/onboarding/start?id=$($NewRelationship.id)")
62-
} catch {
63-
$OnboardingUrl = $null
71+
$InviteEntity = [PSCustomObject]@{
72+
'PartitionKey' = 'invite'
73+
'RowKey' = $NewRelationship.id
74+
'InviteUrl' = $InviteUrl
75+
'OnboardingUrl' = $OnboardingUrl
76+
'RoleMappings' = [string](@($RoleMappings) | ConvertTo-Json -Depth 10 -Compress)
77+
}
78+
Add-CIPPAzDataTableEntity @Table -Entity $InviteEntity
79+
80+
$Message = 'GDAP relationship invite created. Log in as a Global Admin in the new tenant to approve the invite.'
81+
} else {
82+
$Message = 'Error creating GDAP relationship request'
83+
}
84+
85+
Write-LogMessage -headers $Request.Headers -API $APINAME -message "Created GDAP Invite - $InviteUrl" -Sev 'Info'
6486
}
87+
} catch {
88+
$Message = 'Error creating GDAP relationship, failed at step: ' + $Step
89+
Write-Host "GDAP ERROR: $($_.InvocationInfo.PositionMessage)"
6590

66-
$InviteEntity = [PSCustomObject]@{
67-
'PartitionKey' = 'invite'
68-
'RowKey' = $NewRelationship.id
69-
'InviteUrl' = $InviteUrl
70-
'OnboardingUrl' = $OnboardingUrl
71-
'RoleMappings' = [string](@($RoleMappings) | ConvertTo-Json -Depth 10 -Compress)
91+
if ($Step -eq 'Creating GDAP relationship' -and $_.Exception.Message -match 'The user (principal) does not have the required permissions to perform the specified action on the resource.') {
92+
$Message = 'Error creating GDAP relationship, ensure that all users have MFA enabled and enforced without exception. Please see the Microsoft Partner Security Requirements documentation for more information. https://learn.microsoft.com/en-us/partner-center/security/partner-security-requirements'
93+
} else {
94+
$Message = "$($Message): $($_.Exception.Message)"
7295
}
73-
Add-CIPPAzDataTableEntity @Table -Entity $InviteEntity
7496

75-
$Message = 'GDAP relationship invite created. Log in as a Global Admin in the new tenant to approve the invite.'
76-
} else {
77-
$Message = 'Error creating GDAP relationship request'
97+
Write-LogMessage -headers $Request.Headers -API $APINAME -tenant $env:TenantID -message $Message -Sev 'Error' -LogData (Get-CippException -Exception $_)
7898
}
7999

80-
Write-LogMessage -headers $Request.Headers -API $APINAME -message "Created GDAP Invite - $InviteUrl" -Sev 'Info'
100+
$body = @{
101+
Message = $Message
102+
Invite = $InviteEntity
103+
}
81104
}
82-
} catch {
83-
$Message = 'Error creating GDAP relationship, failed at step: ' + $Step
84-
Write-Host "GDAP ERROR: $($_.InvocationInfo.PositionMessage)"
85-
86-
if ($Step -eq 'Creating GDAP relationship' -and $_.Exception.Message -match 'The user (principal) does not have the required permissions to perform the specified action on the resource.') {
87-
$Message = 'Error creating GDAP relationship, ensure that all users have MFA enabled and enforced without exception. Please see the Microsoft Partner Security Requirements documentation for more information. https://learn.microsoft.com/en-us/partner-center/security/partner-security-requirements'
88-
} else {
89-
$Message = "$($Message): $($_.Exception.Message)"
105+
'Delete' {
106+
$InviteId = $Request.Body.InviteId
107+
$Table = Get-CIPPTable -TableName 'GDAPInvites'
108+
$Invite = Get-CIPPAzDataTableEntity @Table -Filter "PartitionKey eq 'invite' and RowKey eq '$InviteId'"
109+
if ($Invite) {
110+
Remove-AzDataTableEntity @Table -Entity $Invite
111+
$Message = 'Invite deleted'
112+
} else {
113+
$Message = 'Invite not found'
114+
}
115+
$body = @{
116+
Message = $Message
117+
}
90118
}
91119

92-
Write-LogMessage -headers $Request.Headers -API $APINAME -tenant $env:TenantID -message $Message -Sev 'Error' -LogData (Get-CippException -Exception $_)
93-
}
94-
95-
$body = @{
96-
Message = $Message
97-
Invite = $InviteEntity
98120
}
99121
Push-OutputBinding -Name Response -Value ([HttpResponseContext]@{
100122
StatusCode = [HttpStatusCode]::OK

0 commit comments

Comments
 (0)