Skip to content

Commit 1186a4e

Browse files
JohnDupreyJohnDuprey
committed
Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP-API into dev
2 parents e30aaa9 + c9c5a34 commit 1186a4e

14 files changed

Lines changed: 169 additions & 82 deletions

‎Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Identity/Administration/Groups/Invoke-AddGroup.ps1‎

Lines changed: 46 additions & 50 deletions
Original file line numberDiff line numberDiff line change
@@ -11,80 +11,76 @@ Function Invoke-AddGroup {
1111
param($Request, $TriggerMetadata)
1212

1313
$APIName = $Request.Params.CIPPEndpoint
14-
Write-LogMessage -headers $Request.Headers -API $APINAME -message 'Accessed this API' -Sev 'Debug'
14+
$SelectedTenants = if ('AllTenants' -in $SelectedTenants) { (Get-Tenants).defaultDomainName } else { $Request.body.tenantFilter.value ? $Request.body.tenantFilter.value : $Request.body.tenantFilter }
15+
Write-LogMessage -headers $Request.Headers -API $APIName -message 'Accessed this API' -Sev Debug
1516

16-
$groupobj = $Request.body
17-
$SelectedTenants = $request.body.tenantfilter.value ? $request.body.tenantfilter.value : $request.body.tenantfilter
18-
if ('AllTenants' -in $SelectedTenants) { $SelectedTenants = (Get-Tenants).defaultDomainName }
1917

20-
# Write to the Azure Functions log stream.
21-
Write-Host 'PowerShell HTTP trigger function processed a request.'
22-
$results = foreach ($tenant in $SelectedTenants) {
18+
$GroupObject = $Request.body
19+
20+
$Results = foreach ($tenant in $SelectedTenants) {
2321
try {
24-
$email = if ($groupobj.primDomain.value) { "$($groupobj.username)@$($groupobj.primDomain.value)" } else { "$($groupobj.username)@$($tenant)" }
25-
if ($groupobj.groupType -in 'Generic', 'azurerole', 'dynamic', 'm365') {
22+
$Email = if ($GroupObject.primDomain.value) { "$($GroupObject.username)@$($GroupObject.primDomain.value)" } else { "$($GroupObject.username)@$($tenant)" }
23+
if ($GroupObject.groupType -in 'Generic', 'azurerole', 'dynamic', 'm365') {
2624

27-
$BodyToship = [pscustomobject] @{
28-
'displayName' = $groupobj.Displayname
29-
'description' = $groupobj.Description
30-
'mailNickname' = $groupobj.username
25+
$BodyParams = [pscustomobject] @{
26+
'displayName' = $GroupObject.displayName
27+
'description' = $GroupObject.description
28+
'mailNickname' = $GroupObject.username
3129
mailEnabled = [bool]$false
3230
securityEnabled = [bool]$true
33-
isAssignableToRole = [bool]($groupobj | Where-Object -Property groupType -EQ 'AzureRole')
31+
isAssignableToRole = [bool]($GroupObject | Where-Object -Property groupType -EQ 'AzureRole')
3432
}
35-
if ($groupobj.membershipRules) {
36-
$BodyToship | Add-Member -NotePropertyName 'membershipRule' -NotePropertyValue ($groupobj.membershipRules)
37-
$BodyToship | Add-Member -NotePropertyName 'groupTypes' -NotePropertyValue @('DynamicMembership')
38-
$BodyToship | Add-Member -NotePropertyName 'membershipRuleProcessingState' -NotePropertyValue 'On'
33+
if ($GroupObject.membershipRules) {
34+
$BodyParams | Add-Member -NotePropertyName 'membershipRule' -NotePropertyValue ($GroupObject.membershipRules)
35+
$BodyParams | Add-Member -NotePropertyName 'groupTypes' -NotePropertyValue @('DynamicMembership')
36+
$BodyParams | Add-Member -NotePropertyName 'membershipRuleProcessingState' -NotePropertyValue 'On'
3937
}
40-
if ($groupobj.groupType -eq 'm365') {
41-
$BodyToship | Add-Member -NotePropertyName 'groupTypes' -NotePropertyValue @('Unified')
38+
if ($GroupObject.groupType -eq 'm365') {
39+
$BodyParams | Add-Member -NotePropertyName 'groupTypes' -NotePropertyValue @('Unified')
4240
}
43-
if ($groupobj.owners -AND $groupobj.groupType -in 'generic', 'azurerole', 'security') {
44-
$BodyToship | Add-Member -NotePropertyName 'owners@odata.bind' -NotePropertyValue (($groupobj.AddOwner) | ForEach-Object { "https://graph.microsoft.com/v1.0/users/$($_.value)" })
45-
$bodytoship.'owners@odata.bind' = @($bodytoship.'owners@odata.bind')
41+
if ($GroupObject.owners -AND $GroupObject.groupType -in 'generic', 'azurerole', 'security') {
42+
$BodyParams | Add-Member -NotePropertyName 'owners@odata.bind' -NotePropertyValue (($GroupObject.AddOwner) | ForEach-Object { "https://graph.microsoft.com/v1.0/users/$($_.value)" })
43+
$BodyParams.'owners@odata.bind' = @($BodyParams.'owners@odata.bind')
4644
}
47-
if ($groupobj.members -AND $groupobj.groupType -in 'generic', 'azurerole', 'security') {
48-
$BodyToship | Add-Member -NotePropertyName 'members@odata.bind' -NotePropertyValue (($groupobj.AddMember) | ForEach-Object { "https://graph.microsoft.com/v1.0/users/$($_.value)" })
49-
$BodyToship.'members@odata.bind' = @($BodyToship.'members@odata.bind')
45+
if ($GroupObject.members -AND $GroupObject.groupType -in 'generic', 'azurerole', 'security') {
46+
$BodyParams | Add-Member -NotePropertyName 'members@odata.bind' -NotePropertyValue (($GroupObject.AddMember) | ForEach-Object { "https://graph.microsoft.com/v1.0/users/$($_.value)" })
47+
$BodyParams.'members@odata.bind' = @($BodyParams.'members@odata.bind')
5048
}
51-
$GraphRequest = New-GraphPostRequest -uri 'https://graph.microsoft.com/beta/groups' -tenantid $tenant -type POST -body (ConvertTo-Json -InputObject $BodyToship -Depth 10) -verbose
49+
$GraphRequest = New-GraphPostRequest -uri 'https://graph.microsoft.com/beta/groups' -tenantid $tenant -type POST -body (ConvertTo-Json -InputObject $BodyParams -Depth 10) -Verbose
5250
} else {
53-
if ($groupobj.groupType -eq 'dynamicdistribution') {
54-
$Params = @{
55-
Name = $groupobj.Displayname
56-
RecipientFilter = $groupobj.membershipRules
57-
PrimarySmtpAddress = $email
51+
if ($GroupObject.groupType -eq 'dynamicDistribution') {
52+
$ExoParams = @{
53+
Name = $GroupObject.displayName
54+
RecipientFilter = $GroupObject.membershipRules
55+
PrimarySmtpAddress = $Email
5856
}
59-
$GraphRequest = New-ExoRequest -tenantid $tenant -cmdlet 'New-DynamicDistributionGroup' -cmdParams $params
57+
$GraphRequest = New-ExoRequest -tenantid $tenant -cmdlet 'New-DynamicDistributionGroup' -cmdParams $ExoParams
6058
} else {
61-
$Params = @{
62-
Name = $groupobj.Displayname
63-
Alias = $groupobj.username
64-
Description = $groupobj.Description
65-
PrimarySmtpAddress = $email
66-
Type = $groupobj.groupType
67-
RequireSenderAuthenticationEnabled = [bool]!$groupobj.AllowExternal
59+
$ExoParams = @{
60+
Name = $GroupObject.displayName
61+
Alias = $GroupObject.username
62+
Description = $GroupObject.description
63+
PrimarySmtpAddress = $Email
64+
Type = $GroupObject.groupType
65+
RequireSenderAuthenticationEnabled = [bool]!$GroupObject.allowExternal
6866
}
69-
$GraphRequest = New-ExoRequest -tenantid $tenant -cmdlet 'New-DistributionGroup' -cmdParams $params
67+
$GraphRequest = New-ExoRequest -tenantid $tenant -cmdlet 'New-DistributionGroup' -cmdParams $ExoParams
7068
}
71-
#$GraphRequest = New-ExoRequest -tenantid $tenant -cmdlet 'New-DistributionGroup' -cmdParams $params
72-
# At some point add logic to use AddOwner/AddMember for New-DistributionGroup, but idk how we're going to brr that - rvdwegen
7369
}
74-
"Successfully created group $($groupobj.displayname) for $($tenant)"
75-
Write-LogMessage -headers $Request.Headers -API $APINAME -tenant $tenant -message "Created group $($groupobj.displayname) with id $($GraphRequest.id)" -Sev 'Info'
70+
"Successfully created group $($GroupObject.displayName) for $($tenant)"
71+
Write-LogMessage -headers $Request.Headers -API $APIName -tenant $tenant -message "Created group $($GroupObject.displayName) with id $($GraphRequest.id)" -Sev Info
7672

7773
} catch {
78-
Write-LogMessage -headers $Request.Headers -API $APINAME -tenant $tenant -message "Group creation API failed. $($_.Exception.Message)" -Sev 'Error'
79-
"Failed to create group. $($groupobj.displayname) for $($tenant) $($_.Exception.Message)"
74+
$ErrorMessage = Get-CippException -Exception $_
75+
Write-LogMessage -headers $Request.Headers -API $APIName -tenant $tenant -message "Group creation API failed. $($ErrorMessage.NormalizedError)" -Sev Error -LogData $ErrorMessage
76+
"Failed to create group. $($GroupObject.displayName) for $($tenant) $($ErrorMessage.NormalizedError)"
8077
}
8178
}
82-
$body = [pscustomobject]@{'Results' = @($results) }
79+
$ResponseBody = [pscustomobject]@{'Results' = @($Results) }
8380

8481
# Associate values to output bindings by calling 'Push-OutputBinding'.
8582
Push-OutputBinding -Name Response -Value ([HttpResponseContext]@{
8683
StatusCode = [HttpStatusCode]::OK
87-
Body = $Body
84+
Body = $ResponseBody
8885
})
89-
9086
}

‎Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Tenant/Administration/Invoke-SetAuthMethod.ps1‎

Lines changed: 9 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -5,28 +5,23 @@ function Invoke-SetAuthMethod {
55
.ROLE
66
Tenant.Administration.ReadWrite
77
#>
8-
Param(
9-
$Request,
10-
$TriggerMetadata
11-
)
8+
Param($Request, $TriggerMetadata)
129

13-
$APIName = "Set Authentication Policy"
14-
$state = if ($Request.Body.state -eq 'enabled') { $true } else { $false }
15-
$Tenantfilter = $Request.Body.TenantFilter
10+
$APIName = $Request.Params.CIPPEndpoint
11+
$State = if ($Request.Body.state -eq 'enabled') { $true } else { $false }
12+
$TenantFilter = $Request.Body.tenantFilter
1613

1714
try {
18-
Set-CIPPAuthenticationPolicy -Tenant $Tenantfilter -APIName $APIName -AuthenticationMethodId $($Request.Body.Id) -Enabled $state
15+
$Result = Set-CIPPAuthenticationPolicy -Tenant $TenantFilter -APIName $APIName -AuthenticationMethodId $($Request.Body.Id) -Enabled $State -Headers $Request.Headers
1916
$StatusCode = [HttpStatusCode]::OK
20-
$SuccessMessage = "Authentication Policy for $($Request.Body.Id) has been set to $state"
2117
} catch {
22-
$ErrorMsg = Get-NormalizedError -message $($_.Exception.Message)
23-
$SuccessMessage = "Function Error: $($_.InvocationInfo.ScriptLineNumber) - $ErrorMsg"
24-
$StatusCode = [HttpStatusCode]::BadRequest
18+
$Result = $_
19+
$StatusCode = [HttpStatusCode]::Forbidden
2520
}
2621

2722
# Associate values to output bindings by calling 'Push-OutputBinding'.
2823
Push-OutputBinding -Name Response -Value ([HttpResponseContext]@{
2924
StatusCode = $StatusCode
30-
Body = [pscustomobject]@{'Results' = "$SuccessMessage" }
25+
Body = [pscustomobject]@{'Results' = "$Result" }
3126
})
32-
}
27+
}

‎Modules/CIPPCore/Public/Set-CIPPAuthenticationPolicy.ps1‎

Lines changed: 17 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -2,14 +2,16 @@ function Set-CIPPAuthenticationPolicy {
22
[CmdletBinding(SupportsShouldProcess = $true)]
33
param(
44
[Parameter(Mandatory = $true)]$Tenant,
5-
[Parameter(Mandatory = $true)][ValidateSet('FIDO2', 'MicrosoftAuthenticator', 'SMS', 'TemporaryAccessPass', 'HardwareOATH', 'softwareOath', 'Voice', 'Email', 'x509Certificate')]$AuthenticationMethodId,
5+
[Parameter(Mandatory = $true)][ValidateSet('FIDO2', 'MicrosoftAuthenticator', 'SMS', 'TemporaryAccessPass', 'HardwareOATH', 'softwareOath', 'Voice', 'Email', 'x509Certificate', 'QRCodePin')]$AuthenticationMethodId,
66
[Parameter(Mandatory = $true)][bool]$Enabled, # true = enabled or false = disabled
77
$MicrosoftAuthenticatorSoftwareOathEnabled,
88
$TAPMinimumLifetime = 60, #Minutes
99
$TAPMaximumLifetime = 480, #minutes
1010
$TAPDefaultLifeTime = 60, #minutes
1111
$TAPDefaultLength = 8, #TAP password generated length in chars
1212
$TAPisUsableOnce = $true,
13+
[Parameter()][ValidateRange(1, 395)]$QRCodeLifetimeInDays = 365,
14+
[Parameter()][ValidateRange(8, 20)]$QRCodePinLength = 8,
1315
$APIName = 'Set Authentication Policy',
1416
$Headers
1517
)
@@ -56,7 +58,7 @@ function Set-CIPPAuthenticationPolicy {
5658
'SMS' {
5759
if ($State -eq 'enabled') {
5860
Write-LogMessage -headers $Headers -API $APIName -tenant $Tenant -message "Setting $AuthenticationMethodId to enabled is not allowed" -sev Error
59-
return "Setting $AuthenticationMethodId to enabled is not allowed"
61+
throw "Setting $AuthenticationMethodId to enabled is not allowed"
6062
}
6163
}
6264

@@ -87,39 +89,47 @@ function Set-CIPPAuthenticationPolicy {
8789
# Disallow enabling voice
8890
if ($State -eq 'enabled') {
8991
Write-LogMessage -headers $Headers -API $APIName -tenant $Tenant -message "Setting $AuthenticationMethodId to enabled is not allowed" -sev Error
90-
return "Setting $AuthenticationMethodId to enabled is not allowed"
92+
throw "Setting $AuthenticationMethodId to enabled is not allowed"
9193
}
9294
}
9395

9496
# Email OTP
9597
'Email' {
9698
if ($State -eq 'enabled') {
9799
Write-LogMessage -headers $Headers -API $APIName -tenant $Tenant -message "Setting $AuthenticationMethodId to enabled is not allowed" -sev Error
98-
return "Setting $AuthenticationMethodId to enabled is not allowed"
100+
throw "Setting $AuthenticationMethodId to enabled is not allowed"
99101
}
100102
}
101103

102104
# Certificate-based authentication
103105
'x509Certificate' {
104106
# Nothing special to do here
105107
}
108+
109+
# QR code
110+
'QRCodePin' {
111+
if ($State -eq 'enabled') {
112+
Write-LogMessage -headers $Headers -API $APIName -tenant $Tenant -message "Setting $AuthenticationMethodId to enabled is not allowed" -sev Error
113+
throw "Setting $AuthenticationMethodId to enabled is not allowed"
114+
}
115+
}
106116
Default {
107117
Write-LogMessage -headers $Headers -API $APIName -tenant $Tenant -message "Somehow you hit the default case with an input of $AuthenticationMethodId . You probably made a typo in the input for AuthenticationMethodId. It`'s case sensitive." -sev Error
108-
return "Somehow you hit the default case with an input of $AuthenticationMethodId . You probably made a typo in the input for AuthenticationMethodId. It`'s case sensitive."
118+
throw "Somehow you hit the default case with an input of $AuthenticationMethodId . You probably made a typo in the input for AuthenticationMethodId. It`'s case sensitive."
109119
}
110120
}
111121
# Set state of the authentication method
112122
try {
113123
if ($PSCmdlet.ShouldProcess($AuthenticationMethodId, "Set state to $State $OptionalLogMessage")) {
114124
# Convert body to JSON and send request
115-
$null = New-GraphPostRequest -tenantid $Tenant -Uri "https://graph.microsoft.com/beta/policies/authenticationmethodspolicy/authenticationMethodConfigurations/$AuthenticationMethodId" -Type patch -Body ($CurrentInfo | ConvertTo-Json -Compress -Depth 10) -ContentType 'application/json'
125+
$null = New-GraphPostRequest -tenantid $Tenant -Uri "https://graph.microsoft.com/beta/policies/authenticationmethodspolicy/authenticationMethodConfigurations/$AuthenticationMethodId" -Type PATCH -Body (ConvertTo-Json -InputObject $CurrentInfo -Compress -Depth 10) -ContentType 'application/json'
116126
Write-LogMessage -headers $Headers -API $APIName -tenant $Tenant -message "Set $AuthenticationMethodId state to $State $OptionalLogMessage" -sev Info
117127
}
118128
return "Set $AuthenticationMethodId state to $State $OptionalLogMessage"
119129

120130
} catch {
121131
$ErrorMessage = Get-CippException -Exception $_
122132
Write-LogMessage -headers $Headers -API $APIName -tenant $Tenant -message "Failed to $State $AuthenticationMethodId Support: $ErrorMessage" -sev Error -LogData $ErrorMessage
123-
return "Failed to $State $AuthenticationMethodId Support. Error: $($ErrorMessage.NormalizedError)"
133+
throw "Failed to $State $AuthenticationMethodId Support. Error: $($ErrorMessage.NormalizedError)"
124134
}
125135
}

‎Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableEmail.ps1‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,10 @@ function Invoke-CIPPStandardDisableEmail {
3636
if ($StateIsCorrect -eq $true) {
3737
Write-LogMessage -API 'Standards' -tenant $tenant -message 'Email authentication method is already disabled.' -sev Info
3838
} else {
39-
Set-CIPPAuthenticationPolicy -Tenant $tenant -APIName 'Standards' -AuthenticationMethodId 'Email' -Enabled $false
39+
try {
40+
Set-CIPPAuthenticationPolicy -Tenant $tenant -APIName 'Standards' -AuthenticationMethodId 'Email' -Enabled $false
41+
} catch {
42+
}
4043
}
4144
}
4245

‎Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableQRCodePin.ps1‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
function Invoke-CIPPStandardDisableQRCodePin {
2+
<#
3+
.FUNCTIONALITY
4+
Internal
5+
.COMPONENT
6+
(APIName) DisableQRCodePin
7+
.SYNOPSIS
8+
(Label) Disables QR Code Pin as an MFA method
9+
.DESCRIPTION
10+
(Helptext) This blocks users from using QR Code Pin as an MFA method. If a user only has QR Code Pin as a MFA method, they will be unable to log in.
11+
(DocsDescription) Disables QR Code Pin as an MFA method for the tenant. If a user only has QR Code Pin as a MFA method, they will be unable to sign in.
12+
.NOTES
13+
CAT
14+
Entra (AAD) Standards
15+
TAG
16+
"highimpact"
17+
ADDEDCOMPONENT
18+
IMPACT
19+
High Impact
20+
POWERSHELLEQUIVALENT
21+
Update-MgBetaPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration
22+
RECOMMENDEDBY
23+
UPDATECOMMENTBLOCK
24+
Run the Tools\Update-StandardsComments.ps1 script to update this comment block
25+
.LINK
26+
https://docs.cipp.app/user-documentation/tenant/standards/list-standards/entra-aad-standards#high-impact
27+
#>
28+
29+
param($Tenant, $Settings)
30+
31+
$CurrentState = New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/policies/authenticationmethodspolicy/authenticationMethodConfigurations/QRCodePin' -tenantid $Tenant
32+
$StateIsCorrect = ($CurrentState.state -eq 'disabled')
33+
34+
If ($Settings.remediate -eq $true) {
35+
if ($StateIsCorrect -eq $true) {
36+
Write-LogMessage -API 'Standards' -tenant $tenant -message 'QR Code Pin authentication method is already disabled.' -sev Info
37+
} else {
38+
try {
39+
Set-CIPPAuthenticationPolicy -Tenant $tenant -APIName 'Standards' -AuthenticationMethodId 'QRCodePin' -Enabled $false
40+
} catch {
41+
}
42+
}
43+
}
44+
45+
if ($Settings.alert -eq $true) {
46+
if ($StateIsCorrect -eq $true) {
47+
Write-LogMessage -API 'Standards' -tenant $tenant -message 'QR Code Pin authentication method is not enabled' -sev Info
48+
} else {
49+
Write-LogMessage -API 'Standards' -tenant $tenant -message 'QR Code Pin authentication method is enabled' -sev Alert
50+
}
51+
}
52+
53+
if ($Settings.report -eq $true) {
54+
Add-CIPPBPAField -FieldName 'DisableQRCodePin' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
55+
}
56+
}

‎Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableSMS.ps1‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,10 @@ function Invoke-CIPPStandardDisableSMS {
3636
if ($StateIsCorrect -eq $true) {
3737
Write-LogMessage -API 'Standards' -tenant $tenant -message 'SMS authentication method is already disabled.' -sev Info
3838
} else {
39-
Set-CIPPAuthenticationPolicy -Tenant $tenant -APIName 'Standards' -AuthenticationMethodId 'SMS' -Enabled $false
39+
try {
40+
Set-CIPPAuthenticationPolicy -Tenant $tenant -APIName 'Standards' -AuthenticationMethodId 'SMS' -Enabled $false
41+
} catch {
42+
}
4043
}
4144
}
4245

0 commit comments

Comments
 (0)