Skip to content

Commit 732ad86

Browse files
kris6673kris6673
committed
feat:Make JIT admin support all tenants view
1 parent 02be9d3 commit 732ad86

File tree

2 files changed

+33
-47
lines changed

2 files changed

+33
-47
lines changed

‎Modules/CIPPCore/Public/Entrypoints/Activity Triggers/Push-ExecJITAdminListAllTenants.ps1

Lines changed: 9 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,6 @@ function Push-ExecJITAdminListAllTenants {
77

88
$Tenant = Get-Tenants -TenantFilter $Item.customerId
99
$DomainName = $Tenant.defaultDomainName
10-
Write-Host "Processing push queue for JIT Admin for tenant: $DomainName"
1110
$Table = Get-CIPPTable -TableName CacheJITAdmin
1211

1312
try {
@@ -62,17 +61,18 @@ function Push-ExecJITAdminListAllTenants {
6261
accountEnabled = $currentUser.accountEnabled
6362
jitAdminEnabled = $jitAdminEnabled
6463
jitAdminExpiration = $jitAdminExpiration
65-
memberOf = ($MemberOf | ConvertTo-Json -Depth 5 -Compress) # Store as JSON string
64+
memberOf = ($MemberOf | ConvertTo-Json -Depth 5 -Compress)
6665
}
6766
}
6867

6968
# Add to Azure Table
7069
foreach ($result in $Results) {
7170
$GUID = (New-Guid).Guid
71+
Write-Host ($result | ConvertTo-Json -Depth 10 -Compress)
7272
$GraphRequest = @{
73-
JITAdminUser = ($result | ConvertTo-Json -Depth 10 -Compress)
73+
JITAdminUser = [string]($result | ConvertTo-Json -Depth 10 -Compress)
7474
RowKey = [string]$GUID
75-
PartitionKey = 'JITAdminUsers' # Use the specified partition key
75+
PartitionKey = 'JITAdminUser'
7676
Tenant = [string]$DomainName
7777
UserId = [string]$result.id # Add UserId for easier querying if needed
7878
UserUPN = [string]$result.userPrincipalName # Add UserUPN for easier querying
@@ -89,23 +89,21 @@ function Push-ExecJITAdminListAllTenants {
8989

9090
} catch {
9191
$GUID = (New-Guid).Guid
92-
$ErrorRecord = $_ | Select-Object *
9392
$ErrorMessage = "Could not process JIT Admin users for Tenant: $($DomainName). Error: $($_.Exception.Message)"
9493
if ($_.ScriptStackTrace) {
9594
$ErrorMessage += " StackTrace: $($_.ScriptStackTrace)"
9695
}
9796
$ErrorJson = ConvertTo-Json -InputObject @{
9897
Tenant = $DomainName
9998
Error = $ErrorMessage
100-
Exception = ($_.Exception | ConvertTo-Json -Depth 3 -Compress)
101-
FullError = ($ErrorRecord | ConvertTo-Json -Depth 3 -Compress)
99+
Exception = ($_.Exception.Message | ConvertTo-Json -Depth 3 -Compress)
102100
Timestamp = (Get-Date).ToString('s')
103101
}
104102
$GraphRequest = @{
105-
JITAdminUserError = [string]$ErrorJson
106-
RowKey = [string]$GUID
107-
PartitionKey = 'JITAdminUsers_Error' # Differentiate errors
108-
Tenant = [string]$DomainName
103+
JITAdminUser = [string]$ErrorJson
104+
RowKey = [string]$GUID
105+
PartitionKey = 'JITAdminUser'
106+
Tenant = [string]$DomainName
109107
}
110108
Add-CIPPAzDataTableEntity @Table -Entity $GraphRequest -Force | Out-Null
111109
Write-Error ('Error processing JIT Admin for {0}: {1}' -f $DomainName, $_.Exception.Message)

‎Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecJITAdmin.ps1

Lines changed: 24 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,8 @@ function Invoke-ExecJITAdmin {
1717

1818
if ($Request.Query.Action -eq 'List') {
1919
$Schema = Get-CIPPSchemaExtensions | Where-Object { $_.id -match '_cippUser' } | Select-Object -First 1
20-
if ($TenantFilter -ne 'AllTenants') {
20+
if ($Request.Query.TenantFilter -ne 'AllTenants') {
21+
# Single tenant logic
2122
$Query = @{
2223
TenantFilter = $Request.Query.TenantFilter
2324
Endpoint = 'users'
@@ -36,7 +37,6 @@ function Invoke-ExecJITAdmin {
3637
}
3738
)
3839
}
39-
# Use $TenantFilter consistently, which is derived from Body or Query params at line 15
4040
$RoleResults = New-GraphBulkRequest -tenantid $Request.Query.TenantFilter -Requests @($BulkRequests)
4141
#Write-Information ($RoleResults | ConvertTo-Json -Depth 10 )
4242
$Results = $Users | ForEach-Object {
@@ -63,34 +63,30 @@ function Invoke-ExecJITAdmin {
6363
# AllTenants logic
6464
$Results = [System.Collections.Generic.List[object]]::new()
6565
$Metadata = @{}
66-
# Assumed table name for JIT Admin cache. User might need to adjust.
6766
$Table = Get-CIPPTable -TableName CacheJITAdmin
68-
$PartitionKey = 'JITAdminUsers' # Assumed partition key
69-
70-
# Filter for recent data, e.g., last 60 minutes. Orchestrator populates this.
67+
$PartitionKey = 'JITAdminUser'
7168
$Filter = "PartitionKey eq '$PartitionKey'"
72-
$Rows = Get-CIPPAzDataTableEntity @Table -filter $Filter | Where-Object -Property Timestamp -GT (Get-Date).AddMinutes(-1)
69+
$Rows = Get-CIPPAzDataTableEntity @Table -filter $Filter | Where-Object -Property Timestamp -GT (Get-Date).AddMinutes(-60)
7370

7471
$QueueReference = '{0}-{1}' -f $Request.Query.TenantFilter, $PartitionKey # $TenantFilter is 'AllTenants'
72+
Write-Information "QueueReference: $QueueReference"
7573
$RunningQueue = Invoke-ListCippQueue | Where-Object { $_.Reference -eq $QueueReference -and $_.Status -notmatch 'Completed' -and $_.Status -notmatch 'Failed' }
7674

7775
if ($RunningQueue) {
7876
$Metadata = [PSCustomObject]@{
7977
QueueMessage = 'Still loading JIT Admin data for all tenants. Please check back in a few more minutes.'
8078
}
81-
$Results.Add([PSCustomObject]@{ Waiting = $true })
82-
} elseif (!$dRows -and !$RunningQueue) {
79+
} elseif (!$Rows -and !$RunningQueue) {
8380
$TenantList = Get-Tenants -IncludeErrors
84-
$QueueLink = if ($Request.RequestUri) { $Request.RequestUri.ToString() -replace $Request.Query.Action, 'List' } else { '/identity/administration/users/jit-admin?Action=List&TenantFilter=AllTenants' } # Fallback link
85-
$Queue = New-CippQueueEntry -Name 'JIT Admin List - All Tenants' -Link $QueueLink -Reference $QueueReference -TotalTasks ($TenantList | Measure-Object).Count
81+
$Queue = New-CippQueueEntry -Name 'JIT Admin List - All Tenants' -Link '/identity/administration/jit-admin?tenantFilter=AllTenants' -Reference $QueueReference -TotalTasks ($TenantList | Measure-Object).Count
8682

8783
$Metadata = [PSCustomObject]@{
8884
QueueMessage = 'Loading JIT Admin data for all tenants. Please check back in a few minutes.'
8985
}
9086
$InputObject = [PSCustomObject]@{
91-
OrchestratorName = 'JITAdminListAllTenantsOrchestrator' # Assumed orchestrator name
87+
OrchestratorName = 'JITAdminOrchestrator'
9288
QueueFunction = @{
93-
FunctionName = 'GetTenants' # Generic entry, durable function handles per-tenant logic
89+
FunctionName = 'GetTenants'
9490
QueueId = $Queue.RowKey
9591
TenantParams = @{
9692
IncludeErrors = $true
@@ -100,32 +96,24 @@ function Invoke-ExecJITAdmin {
10096
SkipLog = $true
10197
}
10298
Start-NewOrchestration -FunctionName 'CIPPOrchestrator' -InputObject ($InputObject | ConvertTo-Json -Depth 5 -Compress)
103-
$Results.Add([PSCustomObject]@{ Waiting = $true })
10499
} else {
105-
# $dRows exist
100+
# There is data in the cache, so we will use that
101+
Write-Information "Found $($Rows.Count) rows in the cache"
106102
foreach ($row in $Rows) {
107-
# Assuming $row.JITUserObject contains the serialized PSCustomObject for the user's JIT details
108-
# And $row.TenantId (or $row.TenantDisplayName) contains the tenant identifier
109-
try {
110-
$UserObject = $row.JITUserObject | ConvertFrom-Json
111-
$Results.Add(
112-
[PSCustomObject]@{
113-
Tenant = $row.TenantId # Or TenantDisplayName, ensure orchestrator stores this
114-
id = $UserObject.id
115-
displayName = $UserObject.displayName
116-
userPrincipalName = $UserObject.userPrincipalName
117-
accountEnabled = $UserObject.accountEnabled
118-
jitAdminEnabled = $UserObject.jitAdminEnabled
119-
jitAdminExpiration = $UserObject.jitAdminExpiration
120-
memberOf = $UserObject.memberOf # This should be an array of role objects
121-
}
122-
)
123-
} catch {
124-
Write-LogMessage -Headers $User -API $APIName -message "Failed to process cached JIT admin row for Tenant $($row.TenantId), RowKey $($row.RowKey). Error: $($_.Exception.Message)" -Sev 'Warning'
125-
# Optionally add a placeholder or skip if critical
126-
}
103+
$UserObject = $row.JITAdminUser | ConvertFrom-Json
104+
$Results.Add(
105+
[PSCustomObject]@{
106+
Tenant = $row.Tenant
107+
id = $UserObject.id
108+
displayName = $UserObject.displayName
109+
userPrincipalName = $UserObject.userPrincipalName
110+
accountEnabled = $UserObject.accountEnabled
111+
jitAdminEnabled = $UserObject.jitAdminEnabled
112+
jitAdminExpiration = $UserObject.jitAdminExpiration
113+
memberOf = $UserObject.memberOf
114+
}
115+
)
127116
}
128-
$Metadata = @{ Info = 'Displaying cached JIT Admin data for all tenants.' }
129117
}
130118
$Body = @{
131119
Results = @($Results)

0 commit comments

Comments
 (0)