add automatic secret rotation

Author: JohnDuprey

Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-UpdateTokensTimer.ps1

@@ -37,15 +37,63 @@ function Start-UpdateTokensTimer {
                 }
             }
         } catch {
+            Write-Warning "Error updating refresh token $($_.Exception.Message)."
+            Write-Information ($_.InvocationInfo.PositionMessage)
             Write-LogMessage -API 'Update Tokens' -message 'Error updating refresh token, see Log Data for details. Will try again in 7 days.' -sev 'CRITICAL' -LogData (Get-CippException -Exception $_)
         }
 
+        # Check application secret expiration for $env:ApplicationId and generate a new application secret if expiration is within 30 days.
+        try {
+            $AppId = $env:ApplicationID
+            $PasswordCredentials = New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/applications(appId='$AppId')?`$select=id,passwordCredentials" -NoAuthCheck $true -AsApp $true -ErrorAction Stop
+            # sort by latest expiration date and get the first one
+            $LastPasswordCredential = $PasswordCredentials.passwordCredentials | Sort-Object -Property endDateTime -Descending | Select-Object -First 1
+            if ($LastPasswordCredential.endDateTime -lt (Get-Date).AddDays(30).ToUniversalTime()) {
+                Write-Information "Application secret for $AppId is expiring soon. Generating a new application secret."
+                $AppSecret = New-GraphPostRequest -uri "https://graph.microsoft.com/v1.0/applications/$($PasswordCredentials.id)/addPassword" -Body '{"passwordCredential":{"displayName":"UpdateTokens"}}' -NoAuthCheck $true -AsApp $true -ErrorAction Stop
+                Write-Information "New application secret generated for $AppId. Expiration date: $($AppSecret.endDateTime)."
+            } else {
+                Write-Information "Application secret for $AppId is valid until $($LastPasswordCredential.endDateTime). No need to generate a new application secret."
+            }
+
+            if ($AppSecret) {
+                if ($env:AzureWebJobsStorage -eq 'UseDevelopmentStorage=true') {
+                    $Table = Get-CIPPTable -tablename 'DevSecrets'
+                    $Secret = Get-CIPPAzDataTableEntity @Table -Filter "PartitionKey eq 'Secret' and RowKey eq 'Secret'"
+                    $Secret.ApplicationSecret = $AppSecret.secretText
+                    Add-AzDataTableEntity @Table -Entity $Secret -Force
+                } else {
+                    Set-AzKeyVaultSecret -VaultName $KV -Name 'ApplicationSecret' -SecretValue (ConvertTo-SecureString -String $AppSecret.secretText -AsPlainText -Force)
+                }
+            }
+
+            # Clean up expired application secrets
+            $ExpiredSecrets = $PasswordCredentials.passwordCredentials | Where-Object { $_.endDateTime -lt (Get-Date).ToUniversalTime() }
+            if ($ExpiredSecrets.Count -gt 0) {
+                Write-Information "Found $($ExpiredSecrets.Count) expired application secrets for $AppId. Removing them."
+                foreach ($Secret in $ExpiredSecrets) {
+                    try {
+                        New-GraphPostRequest -type DELETE -uri "https://graph.microsoft.com/v1.0/applications/$($PasswordCredentials.id)/removePassword" -Body "{`"keyId`":`"$($Secret.keyId)`"}" -NoAuthCheck $true -AsApp $true -ErrorAction Stop
+                        Write-Information "Removed expired application secret with keyId $($Secret.keyId)."
+                    } catch {
+                        Write-LogMessage -API 'Update Tokens' -message "Error removing expired application secret with keyId $($Secret.keyId), see Log Data for details." -sev 'CRITICAL' -LogData (Get-CippException -Exception $_)
+                    }
+                }
+            } else {
+                Write-Information "No expired application secrets found for $AppId."
+            }
+        } catch {
+            Write-Warning "Error updating application secret $($_.Exception.Message)."
+            Write-Information ($_.InvocationInfo.PositionMessage)
+            Write-LogMessage -API 'Update Tokens' -message 'Error updating application secret, will try again in 7 days' -sev 'CRITICAL' -LogData (Get-CippException -Exception $_)
+        }
+
         # Get new refresh token for each direct added tenant
         $TenantList = Get-Tenants -IncludeAll | Where-Object { $_.Excluded -eq $false -and $_.delegatedPrivilegeStatus -eq 'directTenant' }
         if ($TenantList.Count -eq 0) {
             Write-Information 'No direct tenants found for refresh token update.'
         } else {
-            Write-Information "Found $($TenantList.Count) direct tenants for refresh token update."
+            Write-Information "Found $($TenantList.Count) direct tenant(s) for refresh token update."
             foreach ($Tenant in $TenantList) {
                 try {
                     Write-Information "Updating refresh token for tenant $($Tenant.displayName) - $($Tenant.customerId)"
@@ -62,13 +110,6 @@ function Start-UpdateTokensTimer {
                             Write-LogMessage -API 'Update Tokens' -tenant $Tenant.defaultDomainName -tenantid $Tenant.customerId -message "Could not update refresh token for tenant $($Tenant.displayName). Will try again in 7 days." -sev 'CRITICAL'
                         }
                     } else {
-                        if ($env:MSI_SECRET) {
-                            Disable-AzContextAutosave -Scope Process | Out-Null
-                            $null = Connect-AzAccount -Identity
-                            $SubscriptionId = $env:WEBSITE_OWNER_NAME -split '\+' | Select-Object -First 1
-                            $null = Set-AzContext -SubscriptionId $SubscriptionId
-                        }
-                        $KV = ($env:WEBSITE_DEPLOYMENT_ID -split '-')[0]
                         if ($Refreshtoken) {
                             $name = $Tenant.customerId
                             Set-AzKeyVaultSecret -VaultName $KV -Name $name -SecretValue (ConvertTo-SecureString -String $Refreshtoken -AsPlainText -Force)
@@ -84,7 +125,6 @@ function Start-UpdateTokensTimer {
         }
 
         # Write an information log with the current time.
-        Write-Information "PowerShell timer trigger function ran! TIME: $currentUTCtime"
-
+        Write-Information "UpdateTokens completed: $currentUTCtime"
     }
 }