Skip to content

Commit c9c5a34

Browse files
KelvinTegelaarKelvinTegelaar
authored
Merge pull request KelvinTegelaar#1301 from kris6673/qrcode-support
FEAT: Add QR code authentication method support
2 parents 38de6c2 + 282623e commit c9c5a34

13 files changed

Lines changed: 123 additions & 32 deletions

‎Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Tenant/Administration/Invoke-SetAuthMethod.ps1‎

Lines changed: 9 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -5,28 +5,23 @@ function Invoke-SetAuthMethod {
55
.ROLE
66
Tenant.Administration.ReadWrite
77
#>
8-
Param(
9-
$Request,
10-
$TriggerMetadata
11-
)
8+
Param($Request, $TriggerMetadata)
129

13-
$APIName = "Set Authentication Policy"
14-
$state = if ($Request.Body.state -eq 'enabled') { $true } else { $false }
15-
$Tenantfilter = $Request.Body.TenantFilter
10+
$APIName = $Request.Params.CIPPEndpoint
11+
$State = if ($Request.Body.state -eq 'enabled') { $true } else { $false }
12+
$TenantFilter = $Request.Body.tenantFilter
1613

1714
try {
18-
Set-CIPPAuthenticationPolicy -Tenant $Tenantfilter -APIName $APIName -AuthenticationMethodId $($Request.Body.Id) -Enabled $state
15+
$Result = Set-CIPPAuthenticationPolicy -Tenant $TenantFilter -APIName $APIName -AuthenticationMethodId $($Request.Body.Id) -Enabled $State -Headers $Request.Headers
1916
$StatusCode = [HttpStatusCode]::OK
20-
$SuccessMessage = "Authentication Policy for $($Request.Body.Id) has been set to $state"
2117
} catch {
22-
$ErrorMsg = Get-NormalizedError -message $($_.Exception.Message)
23-
$SuccessMessage = "Function Error: $($_.InvocationInfo.ScriptLineNumber) - $ErrorMsg"
24-
$StatusCode = [HttpStatusCode]::BadRequest
18+
$Result = $_
19+
$StatusCode = [HttpStatusCode]::Forbidden
2520
}
2621

2722
# Associate values to output bindings by calling 'Push-OutputBinding'.
2823
Push-OutputBinding -Name Response -Value ([HttpResponseContext]@{
2924
StatusCode = $StatusCode
30-
Body = [pscustomobject]@{'Results' = "$SuccessMessage" }
25+
Body = [pscustomobject]@{'Results' = "$Result" }
3126
})
32-
}
27+
}

‎Modules/CIPPCore/Public/Set-CIPPAuthenticationPolicy.ps1‎

Lines changed: 17 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -2,14 +2,16 @@ function Set-CIPPAuthenticationPolicy {
22
[CmdletBinding(SupportsShouldProcess = $true)]
33
param(
44
[Parameter(Mandatory = $true)]$Tenant,
5-
[Parameter(Mandatory = $true)][ValidateSet('FIDO2', 'MicrosoftAuthenticator', 'SMS', 'TemporaryAccessPass', 'HardwareOATH', 'softwareOath', 'Voice', 'Email', 'x509Certificate')]$AuthenticationMethodId,
5+
[Parameter(Mandatory = $true)][ValidateSet('FIDO2', 'MicrosoftAuthenticator', 'SMS', 'TemporaryAccessPass', 'HardwareOATH', 'softwareOath', 'Voice', 'Email', 'x509Certificate', 'QRCodePin')]$AuthenticationMethodId,
66
[Parameter(Mandatory = $true)][bool]$Enabled, # true = enabled or false = disabled
77
$MicrosoftAuthenticatorSoftwareOathEnabled,
88
$TAPMinimumLifetime = 60, #Minutes
99
$TAPMaximumLifetime = 480, #minutes
1010
$TAPDefaultLifeTime = 60, #minutes
1111
$TAPDefaultLength = 8, #TAP password generated length in chars
1212
$TAPisUsableOnce = $true,
13+
[Parameter()][ValidateRange(1, 395)]$QRCodeLifetimeInDays = 365,
14+
[Parameter()][ValidateRange(8, 20)]$QRCodePinLength = 8,
1315
$APIName = 'Set Authentication Policy',
1416
$Headers
1517
)
@@ -56,7 +58,7 @@ function Set-CIPPAuthenticationPolicy {
5658
'SMS' {
5759
if ($State -eq 'enabled') {
5860
Write-LogMessage -headers $Headers -API $APIName -tenant $Tenant -message "Setting $AuthenticationMethodId to enabled is not allowed" -sev Error
59-
return "Setting $AuthenticationMethodId to enabled is not allowed"
61+
throw "Setting $AuthenticationMethodId to enabled is not allowed"
6062
}
6163
}
6264

@@ -87,39 +89,47 @@ function Set-CIPPAuthenticationPolicy {
8789
# Disallow enabling voice
8890
if ($State -eq 'enabled') {
8991
Write-LogMessage -headers $Headers -API $APIName -tenant $Tenant -message "Setting $AuthenticationMethodId to enabled is not allowed" -sev Error
90-
return "Setting $AuthenticationMethodId to enabled is not allowed"
92+
throw "Setting $AuthenticationMethodId to enabled is not allowed"
9193
}
9294
}
9395

9496
# Email OTP
9597
'Email' {
9698
if ($State -eq 'enabled') {
9799
Write-LogMessage -headers $Headers -API $APIName -tenant $Tenant -message "Setting $AuthenticationMethodId to enabled is not allowed" -sev Error
98-
return "Setting $AuthenticationMethodId to enabled is not allowed"
100+
throw "Setting $AuthenticationMethodId to enabled is not allowed"
99101
}
100102
}
101103

102104
# Certificate-based authentication
103105
'x509Certificate' {
104106
# Nothing special to do here
105107
}
108+
109+
# QR code
110+
'QRCodePin' {
111+
if ($State -eq 'enabled') {
112+
Write-LogMessage -headers $Headers -API $APIName -tenant $Tenant -message "Setting $AuthenticationMethodId to enabled is not allowed" -sev Error
113+
throw "Setting $AuthenticationMethodId to enabled is not allowed"
114+
}
115+
}
106116
Default {
107117
Write-LogMessage -headers $Headers -API $APIName -tenant $Tenant -message "Somehow you hit the default case with an input of $AuthenticationMethodId . You probably made a typo in the input for AuthenticationMethodId. It`'s case sensitive." -sev Error
108-
return "Somehow you hit the default case with an input of $AuthenticationMethodId . You probably made a typo in the input for AuthenticationMethodId. It`'s case sensitive."
118+
throw "Somehow you hit the default case with an input of $AuthenticationMethodId . You probably made a typo in the input for AuthenticationMethodId. It`'s case sensitive."
109119
}
110120
}
111121
# Set state of the authentication method
112122
try {
113123
if ($PSCmdlet.ShouldProcess($AuthenticationMethodId, "Set state to $State $OptionalLogMessage")) {
114124
# Convert body to JSON and send request
115-
$null = New-GraphPostRequest -tenantid $Tenant -Uri "https://graph.microsoft.com/beta/policies/authenticationmethodspolicy/authenticationMethodConfigurations/$AuthenticationMethodId" -Type patch -Body ($CurrentInfo | ConvertTo-Json -Compress -Depth 10) -ContentType 'application/json'
125+
$null = New-GraphPostRequest -tenantid $Tenant -Uri "https://graph.microsoft.com/beta/policies/authenticationmethodspolicy/authenticationMethodConfigurations/$AuthenticationMethodId" -Type PATCH -Body (ConvertTo-Json -InputObject $CurrentInfo -Compress -Depth 10) -ContentType 'application/json'
116126
Write-LogMessage -headers $Headers -API $APIName -tenant $Tenant -message "Set $AuthenticationMethodId state to $State $OptionalLogMessage" -sev Info
117127
}
118128
return "Set $AuthenticationMethodId state to $State $OptionalLogMessage"
119129

120130
} catch {
121131
$ErrorMessage = Get-CippException -Exception $_
122132
Write-LogMessage -headers $Headers -API $APIName -tenant $Tenant -message "Failed to $State $AuthenticationMethodId Support: $ErrorMessage" -sev Error -LogData $ErrorMessage
123-
return "Failed to $State $AuthenticationMethodId Support. Error: $($ErrorMessage.NormalizedError)"
133+
throw "Failed to $State $AuthenticationMethodId Support. Error: $($ErrorMessage.NormalizedError)"
124134
}
125135
}

‎Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableEmail.ps1‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,10 @@ function Invoke-CIPPStandardDisableEmail {
3636
if ($StateIsCorrect -eq $true) {
3737
Write-LogMessage -API 'Standards' -tenant $tenant -message 'Email authentication method is already disabled.' -sev Info
3838
} else {
39-
Set-CIPPAuthenticationPolicy -Tenant $tenant -APIName 'Standards' -AuthenticationMethodId 'Email' -Enabled $false
39+
try {
40+
Set-CIPPAuthenticationPolicy -Tenant $tenant -APIName 'Standards' -AuthenticationMethodId 'Email' -Enabled $false
41+
} catch {
42+
}
4043
}
4144
}
4245

‎Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableQRCodePin.ps1‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
function Invoke-CIPPStandardDisableQRCodePin {
2+
<#
3+
.FUNCTIONALITY
4+
Internal
5+
.COMPONENT
6+
(APIName) DisableQRCodePin
7+
.SYNOPSIS
8+
(Label) Disables QR Code Pin as an MFA method
9+
.DESCRIPTION
10+
(Helptext) This blocks users from using QR Code Pin as an MFA method. If a user only has QR Code Pin as a MFA method, they will be unable to log in.
11+
(DocsDescription) Disables QR Code Pin as an MFA method for the tenant. If a user only has QR Code Pin as a MFA method, they will be unable to sign in.
12+
.NOTES
13+
CAT
14+
Entra (AAD) Standards
15+
TAG
16+
"highimpact"
17+
ADDEDCOMPONENT
18+
IMPACT
19+
High Impact
20+
POWERSHELLEQUIVALENT
21+
Update-MgBetaPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration
22+
RECOMMENDEDBY
23+
UPDATECOMMENTBLOCK
24+
Run the Tools\Update-StandardsComments.ps1 script to update this comment block
25+
.LINK
26+
https://docs.cipp.app/user-documentation/tenant/standards/list-standards/entra-aad-standards#high-impact
27+
#>
28+
29+
param($Tenant, $Settings)
30+
31+
$CurrentState = New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/policies/authenticationmethodspolicy/authenticationMethodConfigurations/QRCodePin' -tenantid $Tenant
32+
$StateIsCorrect = ($CurrentState.state -eq 'disabled')
33+
34+
If ($Settings.remediate -eq $true) {
35+
if ($StateIsCorrect -eq $true) {
36+
Write-LogMessage -API 'Standards' -tenant $tenant -message 'QR Code Pin authentication method is already disabled.' -sev Info
37+
} else {
38+
try {
39+
Set-CIPPAuthenticationPolicy -Tenant $tenant -APIName 'Standards' -AuthenticationMethodId 'QRCodePin' -Enabled $false
40+
} catch {
41+
}
42+
}
43+
}
44+
45+
if ($Settings.alert -eq $true) {
46+
if ($StateIsCorrect -eq $true) {
47+
Write-LogMessage -API 'Standards' -tenant $tenant -message 'QR Code Pin authentication method is not enabled' -sev Info
48+
} else {
49+
Write-LogMessage -API 'Standards' -tenant $tenant -message 'QR Code Pin authentication method is enabled' -sev Alert
50+
}
51+
}
52+
53+
if ($Settings.report -eq $true) {
54+
Add-CIPPBPAField -FieldName 'DisableQRCodePin' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
55+
}
56+
}

‎Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableSMS.ps1‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,10 @@ function Invoke-CIPPStandardDisableSMS {
3636
if ($StateIsCorrect -eq $true) {
3737
Write-LogMessage -API 'Standards' -tenant $tenant -message 'SMS authentication method is already disabled.' -sev Info
3838
} else {
39-
Set-CIPPAuthenticationPolicy -Tenant $tenant -APIName 'Standards' -AuthenticationMethodId 'SMS' -Enabled $false
39+
try {
40+
Set-CIPPAuthenticationPolicy -Tenant $tenant -APIName 'Standards' -AuthenticationMethodId 'SMS' -Enabled $false
41+
} catch {
42+
}
4043
}
4144
}
4245

‎Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableVoice.ps1‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,10 @@ function Invoke-CIPPStandardDisableVoice {
3636
if ($StateIsCorrect -eq $true) {
3737
Write-LogMessage -API 'Standards' -tenant $tenant -message 'Voice authentication method is already disabled.' -sev Info
3838
} else {
39-
Set-CIPPAuthenticationPolicy -Tenant $tenant -APIName 'Standards' -AuthenticationMethodId 'Voice' -Enabled $false
39+
try {
40+
Set-CIPPAuthenticationPolicy -Tenant $tenant -APIName 'Standards' -AuthenticationMethodId 'Voice' -Enabled $false
41+
} catch {
42+
}
4043
}
4144
}
4245

‎Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisablex509Certificate.ps1‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,10 @@ function Invoke-CIPPStandardDisablex509Certificate {
3636
if ($StateIsCorrect -eq $true) {
3737
Write-LogMessage -API 'Standards' -tenant $tenant -message 'x509Certificate authentication method is already disabled.' -sev Info
3838
} else {
39-
Set-CIPPAuthenticationPolicy -Tenant $tenant -APIName 'Standards' -AuthenticationMethodId 'x509Certificate' -Enabled $false
39+
try {
40+
Set-CIPPAuthenticationPolicy -Tenant $tenant -APIName 'Standards' -AuthenticationMethodId 'x509Certificate' -Enabled $false
41+
} catch {
42+
}
4043
}
4144
}
4245

‎Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEnableFIDO2.ps1‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,10 @@ function Invoke-CIPPStandardEnableFIDO2 {
3636
if ($StateIsCorrect -eq $true) {
3737
Write-LogMessage -API 'Standards' -tenant $tenant -message 'FIDO2 Support is already enabled.' -sev Info
3838
} else {
39-
Set-CIPPAuthenticationPolicy -Tenant $tenant -APIName 'Standards' -AuthenticationMethodId 'Fido2' -Enabled $true
39+
try {
40+
Set-CIPPAuthenticationPolicy -Tenant $tenant -APIName 'Standards' -AuthenticationMethodId 'Fido2' -Enabled $true
41+
} catch {
42+
}
4043
}
4144
}
4245

‎Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEnableHardwareOAuth.ps1‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,10 @@ function Invoke-CIPPStandardEnableHardwareOAuth {
3636
if ($StateIsCorrect -eq $true) {
3737
Write-LogMessage -API 'Standards' -tenant $tenant -message 'HardwareOAuth Support is already enabled.' -sev Info
3838
} else {
39-
Set-CIPPAuthenticationPolicy -Tenant $tenant -APIName 'Standards' -AuthenticationMethodId 'HardwareOath' -Enabled $true
39+
try {
40+
Set-CIPPAuthenticationPolicy -Tenant $tenant -APIName 'Standards' -AuthenticationMethodId 'HardwareOath' -Enabled $true
41+
} catch {
42+
}
4043
}
4144
}
4245

‎Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardPWdisplayAppInformationRequiredState.ps1‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,10 @@ function Invoke-CIPPStandardPWdisplayAppInformationRequiredState {
3838
if ($StateIsCorrect -eq $true) {
3939
Write-LogMessage -API 'Standards' -tenant $tenant -message 'Passwordless with Information and Number Matching is already enabled.' -sev Info
4040
} else {
41-
Set-CIPPAuthenticationPolicy -Tenant $tenant -APIName 'Standards' -AuthenticationMethodId 'MicrosoftAuthenticator' -Enabled $true
41+
try {
42+
Set-CIPPAuthenticationPolicy -Tenant $tenant -APIName 'Standards' -AuthenticationMethodId 'MicrosoftAuthenticator' -Enabled $true
43+
} catch {
44+
}
4245
}
4346
}
4447

0 commit comments

Comments
 (0)