Skip to content

Commit

Permalink
Merge pull request #15 from Pri3st/main
Browse files Browse the repository at this point in the history
Fixed documentation for Entra-related cmdlets
  • Loading branch information
andyrobbins authored Oct 2, 2024
2 parents b6fcb1e + d9d03b5 commit 6f9ea47
Showing 1 changed file with 18 additions and 18 deletions.
36 changes: 18 additions & 18 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -44,29 +44,29 @@ With very few exceptions, Azure API endpoints require authentication to interact

Let's say you want to list all of the users in an Azure Active Directory tenant. You first need to get a token scoped for MS Graph. There are many ways to get this token:

If you have a username/password combination for an AzureAD user in that tenant, you can first acquire a refresh token for the user using BARK's ``Get-AZRefreshTokenWithUsernamePassword`` function:
If you have a username/password combination for an Entra user in that tenant, you can first acquire a refresh token for the user using BARK's ``Get-EntraRefreshTokenWithUsernamePassword`` function:

$MyRefreshTokenRequest = Get-AZRefreshTokenWithUsernamePassword -username "arobbins@contoso.onmicrosoft.com" -password "MyVeryCoolPassword" -TenantID "contoso.onmicrosoft.com"
$MyRefreshTokenRequest = Get-EntraRefreshTokenWithUsernamePassword -username "arobbins@contoso.onmicrosoft.com" -password "MyVeryCoolPassword" -TenantID "contoso.onmicrosoft.com"

The resulting object you just created, `$MyRefreshTokenRequest`, will have as part of it a refresh token for your user. You can now request an MS Graph-scoped token using this refresh token:

$MyMSGraphToken = Get-MSGraphTokenWithRefreshToken -RefreshToken $MyRefreshTokenRequest.refresh_token -TenantID "contoso.onmicrosoft.com"

Now this new object, `$MyMSGraphToken`, will have as one of its property values an MS Graph-scoped JWT for your user. You are now ready to use this token to list all the users in the AzureAD tenant:
Now this new object, `$MyMSGraphToken`, will have as one of its property values an MS Graph-scoped JWT for your user. You are now ready to use this token to list all the users in the Entra tenant:

$MyAADUsers = Get-AllAzureADUsers -Token $MyMSGraphToken.access_token -ShowProgress
$MyUsers = Get-AllEntraUsers -Token $MyMSGraphToken.access_token -ShowProgress

Once finished, the `$MyAADUsers` variable will be populated by objects representing all of the users in your AzureAD tenant.
Once finished, the `$MyEntraUsers` variable will be populated by objects representing all of the users in your Entra tenant.

Token Management and Manipulation Functions
-------------------------------------------

* ``Parse-JWTToken`` will take a Base64 encoded JWT as input and parse it for you. Useful for verifying correct token audience and claims.
* ``Get-AZRefreshTokenWithUsernamePassword`` requests a collection of tokens, including a refresh token, from login.microsoftonline.com with a user-supplied username and password. This will fail if the user has Multi-Factor Authentication requirements or is affected by a Conditional Access Policy.
* ``Get-MSGraphTokenWithClientCredentials`` requests an MS Graph-scoped JWT with a client ID and secret. Useful for authenticating as an AzureAD service principal.
* ``Get-EntraRefreshTokenWithUsernamePassword`` requests a collection of tokens, including a refresh token, from login.microsoftonline.com with a user-supplied username and password. This will fail if the user has Multi-Factor Authentication requirements or is affected by a Conditional Access Policy.
* ``Get-MSGraphTokenWithClientCredentials`` requests an MS Graph-scoped JWT with a client ID and secret. Useful for authenticating as an Entra service principal.
* ``Get-MSGraphTokenWithRefreshToken`` requests an MS Graph-scoped JWT with a user-supplied refresh token.
* ``Get-MSGraphTokenWithPortalAuthRefreshToken`` requests an MS Graph-scoped JWT with a user-supplied Azure Portal Auth Refresh token.
* ``Get-AzureRMTokenWithClientCredentials`` requests an AzureRM-scoped JWT with a client ID and secret. Useful for authenticating as an AzureAD service principal.
* ``Get-AzureRMTokenWithClientCredentials`` requests an AzureRM-scoped JWT with a client ID and secret. Useful for authenticating as an Entra service principal.
* ``Get-ARMTokenWithPortalAuthRefreshToken`` requests an AzureRM-scoped JWT with a user-supplied Azure Portal Auth Refresh token.
* ``Get-ARMTokenWithRefreshToken`` requests an AzureRM-scoped JWT with a user-supplied refresh token.
* ``Get-AzurePortalTokenWithRefreshToken`` requests an Azure Portal Auth Refresh token with a user-supplied refresh token.
Expand All @@ -78,18 +78,18 @@ Abuse Functions
* ``Set-AZUserPassword`` will attempt to set the password of another user to a new user-provided value.
* ``Reset-AZUserPassword`` will attempt to reset the password of another user. If successful, the output will contain the new, Azure-generated password of the user
* ``New-AzureRMRoleAssignment`` will attempt to grant a user-specified AzureRM role assignment to a particular principal over a certain scope.
* ``New-AppRegSecret`` will attempt to create a new secret for an existing AzureAD app registration.
* ``New-ServicePrincipalSecret`` will attempt to create a new secret for an existing AzureAD service principal.
* ``New-AppRegSecret`` will attempt to create a new secret for an existing Entra app registration.
* ``New-ServicePrincipalSecret`` will attempt to create a new secret for an existing Entra service principal.
* ``New-AppRoleAssignment`` will attempt to grant an app role to a service principal. For example, you can use this to grant a service principal the RoleManagement.ReadWrite.Directory app role.

Enumeration Functions
---------------------
* ``Get-AzureRMRoleDefinitions`` collects all role definitions described at a subscription scope, including custom roles.
* ``Get-MGAppRoles`` collects the app roles made available by the MS Graph service principal.
* ``Get-AllAzureADApps`` collects all AzureAD application registration objects.
* ``Get-AllAzureADServicePrincipals`` collects all AzureAD service principal objects.
* ``Get-AllAzureADUsers`` collects all AzureAD users.
* ``Get-AllAzureADGroups`` collects all AzureAD groups.
* ``Get-AllEntraApps`` collects all Entra application registration objects.
* ``Get-AllEntraServicePrincipals`` collects all Entra service principal objects.
* ``Get-AllEntraUsers`` collects all Entra users.
* ``Get-AllEntraGroups`` collects all Entra groups.
* ``Get-AllAzureRMSubscriptions`` collects all AzureRM subscriptions.

Meta Functions
Expand All @@ -101,14 +101,14 @@ Meta Functions
* ``Remove-AbuseTestServicePrincipals`` cleans up abuse tests by removing the serivce principals that were created during testing.
* ``New-TestAppReg`` creates an application registration object for the explicit purpose of abuse validation testing.
* ``New-TestSP`` creates a new service principal and associates it with the app created by the above function.
* ``Test-MGAddSelfAsOwnerOfApp`` is used in abuse validation testing to determine whether a service principal with a particular privilege can grant itself ownership of an existing AzureAD app.
* ``Test-MGAddSelfAsOwnerOfSP`` is used in abuse validation testing to determine whether a service principal with a particular privilege can grant itself ownership of an existing AzureAD service principal.
* ``Test-MGAddSelfToAADRole`` is used in abuse validation testing to determine whether a service principal with a particular privilege can add itself to an AzureAD admin role - Global Admin, for example.
* ``Test-MGAddSelfAsOwnerOfApp`` is used in abuse validation testing to determine whether a service principal with a particular privilege can grant itself ownership of an existing Entra app.
* ``Test-MGAddSelfAsOwnerOfSP`` is used in abuse validation testing to determine whether a service principal with a particular privilege can grant itself ownership of an existing Entra service principal.
* ``Test-MGAddSelfToEntraRole`` is used in abuse validation testing to determine whether a service principal with a particular privilege can add itself to an Entra admin role - Global Admin, for example.
* ``Test-MGAddSelfToMGAppRole``is used in abuse validation testing to determine whether a service principal with a particular privilege can grant itself a particular MS Graph app role without admin consent.
* ``Test-MGAddOwnerToRoleEligibleGroup`` is used to test whether a service principal can grant itself explicit ownership of a role assignable group.
* ``Test-MGAddMemberToRoleEligibleGroup`` is used to test whether the service principal can add itself to a role assignable group.
* ``Test-MGAddSecretToSP`` is used to test whether the service principal can add a new secret to an existing service principal.
* ``Test-MGAddSecretToApp`` is used to test whether the service principal can add a new secret to an existing app.
* ``Invoke-AllAzureMGAbuseTests`` performs all abuse validation tests that can be executed by holding an MS Graph app role. Returns an object describing which privileges were successful at performing each abuse test.
* ``Invoke-AllAzureADAbuseTests`` performs all abuse validation tests that can be executed by principals granted AzureAD admin roles. Returns an object describing which privileges were successful at performing each abuse test.
* ``Invoke-AllEntraAbuseTests`` performs all abuse validation tests that can be executed by principals granted Entra admin roles. Returns an object describing which privileges were successful at performing each abuse test.
* ``ConvertTo-Markdown`` is used for massaging output from the Invoke-<type>Tests functions for usage in another platform.

0 comments on commit 6f9ea47

Please sign in to comment.