Skip to content

Commit 0695179

Browse files
KelvinTegelaarKelvinTegelaar
committed
new sam wizard steps
1 parent 5579488 commit 0695179

File tree

2 files changed

+104
-0
lines changed

2 files changed

+104
-0
lines changed

‎Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Setup/Invoke-ExecCreateSAMApp.ps1

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
using namespace System.Net
2+
3+
Function Invoke-ExecCreateSAMApp {
4+
<#
5+
.FUNCTIONALITY
6+
Entrypoint,AnyTenant
7+
.ROLE
8+
CIPP.AppSettings.ReadWrite.
9+
#>
10+
[System.Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSAvoidUsingConvertToSecureStringWithPlainText', '')]
11+
[CmdletBinding()]
12+
param($Request, $TriggerMetadata)
13+
14+
$KV = $env:WEBSITE_DEPLOYMENT_ID
15+
16+
try {
17+
$Token = $Request.body
18+
if ($Token) {
19+
$URL = ($Request.headers.'x-ms-original-url').split('?') | Select-Object -First 1
20+
$TenantId = (Invoke-RestMethod 'https://graph.microsoft.com/v1.0/organization' -Headers @{ authorization = "Bearer $($Token.access_token)" } -Method GET -ContentType 'application/json').value.id
21+
#Find Existing app registration
22+
$AppId = (Invoke-RestMethod 'https://graph.microsoft.com/v1.0/applications' -Headers @{ authorization = "Bearer $($Token.access_token)" } -Method GET -ContentType 'application/json' -Body "{ `"filter`": `"displayName eq 'CIPP-SAM'`" }").value | Select-Object -Last 1
23+
#Check if the appId has the redirect URI, if not, add it.
24+
if ($AppId) {
25+
Write-Host "Found existing app: $($AppId.id). Reusing."
26+
$state = 'updated'
27+
if ($AppId.web.redirectUris -notcontains $URL) {
28+
$ModuleBase = Get-Module -Name CIPPCore | Select-Object -ExpandProperty ModuleBase
29+
$SamManifestFile = Get-Item (Join-Path $ModuleBase 'Public\SAMManifest.json')
30+
$app = Get-Content $SamManifestFile.FullName | ConvertFrom-Json
31+
$App.web.redirectUris = @($App.web.redirectUris + $URL) #change to SPA URL.
32+
$app = $app | ConvertTo-Json -Depth 15
33+
Invoke-RestMethod "https://graph.microsoft.com/v1.0/applications/$($AppId.id)" -Headers @{ authorization = "Bearer $($Token.access_token)" } -Method PATCH -Body $app -ContentType 'application/json'
34+
}
35+
} else {
36+
$state = 'created'
37+
$ModuleBase = Get-Module -Name CIPPCore | Select-Object -ExpandProperty ModuleBase
38+
$SamManifestFile = Get-Item (Join-Path $ModuleBase 'Public\SAMManifest.json')
39+
$app = Get-Content $SamManifestFile.FullName | ConvertFrom-Json
40+
$App.web.redirectUris = @($App.web.redirectUris + $URL) #change to SPA URL.
41+
$app = $app | ConvertTo-Json -Depth 15
42+
$AppId = (Invoke-RestMethod 'https://graph.microsoft.com/v1.0/applications' -Headers @{ authorization = "Bearer $($Token.access_token)" } -Method POST -Body $app -ContentType 'application/json')
43+
$attempt = 0
44+
do {
45+
try {
46+
try {
47+
$SPNDefender = (Invoke-RestMethod 'https://graph.microsoft.com/v1.0/servicePrincipals' -Headers @{ authorization = "Bearer $($Token.access_token)" } -Method POST -Body "{ `"appId`": `"fc780465-2017-40d4-a0c5-307022471b92`" }" -ContentType 'application/json')
48+
} catch {
49+
Write-Information "didn't deploy spn for defender, probably already there."
50+
}
51+
try {
52+
$SPNTeams = (Invoke-RestMethod 'https://graph.microsoft.com/v1.0/servicePrincipals' -Headers @{ authorization = "Bearer $($Token.access_token)" } -Method POST -Body "{ `"appId`": `"48ac35b8-9aa8-4d74-927d-1f4a14a0b239`" }" -ContentType 'application/json')
53+
} catch {
54+
Write-Information "didn't deploy spn for Teams, probably already there."
55+
}
56+
try {
57+
$SPNO365Manage = (Invoke-RestMethod 'https://graph.microsoft.com/v1.0/servicePrincipals' -Headers @{ authorization = "Bearer $($Token.access_token)" } -Method POST -Body "{ `"appId`": `"c5393580-f805-4401-95e8-94b7a6ef2fc2`" }" -ContentType 'application/json')
58+
} catch {
59+
Write-Information "didn't deploy spn for O365 Management, probably already there."
60+
}
61+
try {
62+
$SPNPartnerCenter = (Invoke-RestMethod 'https://graph.microsoft.com/v1.0/servicePrincipals' -Headers @{ authorization = "Bearer $($Token.access_token)" } -Method POST -Body "{ `"appId`": `"fa3d9a0c-3fb0-42cc-9193-47c7ecd2edbd`" }" -ContentType 'application/json')
63+
} catch {
64+
Write-Information "didn't deploy spn for PartnerCenter, probably already there."
65+
}
66+
$SPN = (Invoke-RestMethod 'https://graph.microsoft.com/v1.0/servicePrincipals' -Headers @{ authorization = "Bearer $($Token.access_token)" } -Method POST -Body "{ `"appId`": `"$($AppId.appId)`" }" -ContentType 'application/json')
67+
Start-Sleep 2
68+
$attempt ++
69+
} catch {
70+
$attempt ++
71+
}
72+
} until ($attempt -gt 3)
73+
}
74+
$AppPassword = (Invoke-RestMethod "https://graph.microsoft.com/v1.0/applications/$($AppId.id)/addPassword" -Headers @{ authorization = "Bearer $($Token.access_token)" } -Method POST -Body '{"passwordCredential":{"displayName":"CIPPInstall"}}' -ContentType 'application/json').secretText
75+
76+
if ($env:AzureWebJobsStorage -eq 'UseDevelopmentStorage=true') {
77+
$DevSecretsTable = Get-CIPPTable -tablename 'DevSecrets'
78+
$Secret = Get-CIPPAzDataTableEntity @DevSecretsTable -Filter "PartitionKey eq 'Secret' and RowKey eq 'Secret'"
79+
$Secret.TenantId = $TenantId
80+
$Secret.ApplicationId = $AppId.appId
81+
$Secret.ApplicationSecret = $AppPassword
82+
Add-CIPPAzDataTableEntity @DevSecretsTable -Entity $Secret -Force
83+
Write-Information ($Secret | ConvertTo-Json -Depth 5)
84+
} else {
85+
Set-AzKeyVaultSecret -VaultName $kv -Name 'tenantid' -SecretValue (ConvertTo-SecureString -String $TenantId -AsPlainText -Force)
86+
Set-AzKeyVaultSecret -VaultName $kv -Name 'applicationid' -SecretValue (ConvertTo-SecureString -String $Appid.appId -AsPlainText -Force)
87+
Set-AzKeyVaultSecret -VaultName $kv -Name 'applicationsecret' -SecretValue (ConvertTo-SecureString -String $AppPassword -AsPlainText -Force)
88+
}
89+
$Results = @{'message' = "Succesfully $state the application registration. The application ID is $($AppId.id). You may continue to the next step."; severity = 'success' }
90+
}
91+
92+
} catch {
93+
$Results = [pscustomobject]@{'Results' = "Failed. $($_.InvocationInfo.ScriptLineNumber): $($_.Exception.message)"; severity = 'failed' }
94+
}
95+
96+
# Associate values to output bindings by calling 'Push-OutputBinding'.
97+
Push-OutputBinding -Name Response -Value ([HttpResponseContext]@{
98+
StatusCode = [HttpStatusCode]::OK
99+
Body = $Results
100+
})
101+
102+
}

‎Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Setup/Invoke-ExecSAMSetup.ps1

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,8 @@ Function Invoke-ExecSAMSetup {
66
Entrypoint,AnyTenant
77
.ROLE
88
CIPP.AppSettings.ReadWrite
9+
.LEGACY
10+
This function is a legacy function that was used to set up the CIPP application in Azure AD. It is not used in the current version of CIPP, look at Invoke-ExecCreateSAMApp for the new version.
911
#>
1012
[System.Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSAvoidUsingConvertToSecureStringWithPlainText', '')]
1113
[CmdletBinding()]

0 commit comments

Comments
 (0)