forked from KelvinTegelaar/CIPP-API
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge branch 'KelvinTegelaar:master' into master
- Loading branch information
Showing
19 changed files
with
323 additions
and
66 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,22 @@ | ||
| # Editor configuration, see http://editorconfig.org | ||
| root = true | ||
|
|
||
| [*] | ||
| charset = utf-8 | ||
| indent_style = space | ||
| insert_final_newline = true | ||
|
|
||
| [*.{ps1, psd1, psm1}] | ||
| indent_size = 4 | ||
| end_of_line = crlf | ||
| trim_trailing_whitespace = true | ||
|
|
||
| [*.json] | ||
| indent_size = 2 | ||
| end_of_line = crlf | ||
| trim_trailing_whitespace = true | ||
|
|
||
| [*.{md, txt}] | ||
| end_of_line = crlf | ||
| max_line_length = off | ||
| trim_trailing_whitespace = false |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
73 changes: 37 additions & 36 deletions
73
Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Setup/Invoke-ExecSAMSetup.ps1
Large diffs are not rendered by default.
Oops, something went wrong.
28 changes: 28 additions & 0 deletions
28
...Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecPerUserMFA.ps1
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,28 @@ | ||
| function Invoke-ExecPerUserMFA { | ||
| <# | ||
| .FUNCTIONALITY | ||
| Entrypoint | ||
| .ROLE | ||
| Identity.User.ReadWrite | ||
| #> | ||
| Param( | ||
| $Request, | ||
| $TriggerMetadata | ||
| ) | ||
|
|
||
| $Request = @{ | ||
| userId = $Request.Body.userId | ||
| TenantFilter = $Request.Body.TenantFilter | ||
| State = $Request.Body.State | ||
| executingUser = $Request.Headers.'x-ms-client-principal' | ||
| } | ||
| $Result = Set-CIPPPerUserMFA @Request | ||
| $Body = @{ | ||
| Results = @($Result) | ||
| } | ||
| Push-OutputBinding -Name Response -Value ([HttpResponseContext]@{ | ||
| StatusCode = [HttpStatusCode]::OK | ||
| Body = $Body | ||
| }) | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,34 @@ | ||
| function Get-CIPPPerUserMFA { | ||
| [CmdletBinding()] | ||
| param( | ||
| $TenantFilter, | ||
| $userId, | ||
| $executingUser, | ||
| $AllUsers = $false | ||
| ) | ||
| try { | ||
| if ($AllUsers -eq $true) { | ||
| $AllUsers = New-graphGetRequest -Uri "https://graph.microsoft.com/beta/users?`$top=999&`$select=UserPrincipalName,Id" -tenantid $tenantfilter | ||
| $Requests = foreach ($id in $AllUsers.userPrincipalName) { | ||
| @{ | ||
| id = $int++ | ||
| method = 'GET' | ||
| url = "users/$id/authentication/requirements" | ||
| } | ||
| } | ||
| $Requests = New-GraphBulkRequest -tenantid $tenantfilter -scope 'https://graph.microsoft.com/.default' -Requests @($Requests) -asapp $true | ||
| if ($Requests.body) { | ||
| $UsersWithoutMFA = $Requests.body | Select-Object peruserMFAState, @{Name = 'UserPrincipalName'; Expression = { [System.Web.HttpUtility]::UrlDecode($_.'@odata.context'.split("'")[1]) } } | ||
| return $UsersWithoutMFA | ||
| } | ||
| } else { | ||
| $MFAState = New-graphGetRequest -Uri "https://graph.microsoft.com/beta/users/$($userId)/authentication/requirements" -tenantid $tenantfilter | ||
| return [PSCustomObject]@{ | ||
| PerUserMFAState = $MFAState.perUserMfaState | ||
| UserPrincipalName = $userId | ||
| } | ||
| } | ||
| } catch { | ||
| "Failed to get MFA State for $id : $_" | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,69 @@ | ||
| function Set-CIPPPerUserMFA { | ||
| <# | ||
| .SYNOPSIS | ||
| Change Per-User MFA State for a User | ||
| .DESCRIPTION | ||
| Change the Per-User MFA State for a user via the /users/{id}/authentication/requirements endpoint | ||
| .PARAMETER TenantFilter | ||
| Tenant where the user resides | ||
| .PARAMETER userId | ||
| One or more User IDs to set the MFA state for (GUID or UserPrincipalName) | ||
| .PARAMETER State | ||
| State to set the user to (enabled, disabled, enforced) | ||
| .PARAMETER executingUser | ||
| User executing the command | ||
| .EXAMPLE | ||
| Set-CIPPPerUserMFA -TenantFilter 'contoso.onmicrosoft.com' -userId user@contoso.onmicrosoft.com -State 'disabled' -executingUser 'mspuser@partner.com' | ||
| #> | ||
| [CmdletBinding()] | ||
| param( | ||
| [Parameter(Mandatory = $true)] | ||
| [string]$TenantFilter, | ||
| [Parameter(Mandatory = $true)] | ||
| [string[]]$userId, | ||
| [ValidateSet('enabled', 'disabled', 'enforced')] | ||
| $State = 'enabled', | ||
| [string]$executingUser = 'CIPP' | ||
| ) | ||
| try { | ||
| $int = 0 | ||
| $Body = @{ | ||
| perUserMFAstate = $State | ||
| } | ||
| $Requests = foreach ($id in $userId) { | ||
| @{ | ||
| id = $int++ | ||
| method = 'PATCH' | ||
| url = "users/$id/authentication/requirements" | ||
| body = $Body | ||
| 'headers' = @{ | ||
| 'Content-Type' = 'application/json' | ||
| } | ||
| } | ||
| } | ||
|
|
||
|
|
||
| $Requests = New-GraphBulkRequest -tenantid $tenantfilter -scope 'https://graph.microsoft.com/.default' -Requests @($Requests) -asapp $true | ||
| "Successfully set Per user MFA State for $userId" | ||
|
|
||
| $Users = foreach ($id in $userId) { | ||
| @{ | ||
| userId = $id | ||
| Properties = @{ | ||
| perUserMfaState = $State | ||
| } | ||
| } | ||
| } | ||
| Set-CIPPUserSchemaProperties -TenantFilter $TenantFilter -Users $Users | ||
| Write-LogMessage -user $executingUser -API 'Set-CIPPPerUserMFA' -message "Successfully set Per user MFA State to $State for $id" -Sev 'Info' -tenant $TenantFilter | ||
| } catch { | ||
| "Failed to set MFA State for $id : $_" | ||
| Write-LogMessage -user $executingUser -API 'Set-CIPPPerUserMFA' -message "Failed to set MFA State to $State for $id : $_" -Sev 'Error' -tenant $TenantFilter | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,46 @@ | ||
| function Set-CIPPUserSchemaProperties { | ||
| <# | ||
| .SYNOPSIS | ||
| Set Schema Properties for a user | ||
| .DESCRIPTION | ||
| Uses scheam extensions to set properties for a user | ||
| .PARAMETER TenantFilter | ||
| Tenant for user | ||
| .PARAMETER UserId | ||
| One or more user ids to set properties for | ||
| .PARAMETER Properties | ||
| Hashtable of properties to set | ||
| #> | ||
| [CmdletBinding(SupportsShouldProcess = $true)] | ||
| Param( | ||
| [Parameter(Mandatory = $true)] | ||
| [string]$TenantFilter, | ||
| [Parameter(Mandatory = $true)] | ||
| [object]$Users | ||
| ) | ||
|
|
||
| $Schema = Get-CIPPSchemaExtensions | Where-Object { $_.id -match '_cippUser' } | ||
| $int = 0 | ||
| $Requests = foreach ($User in $Users) { | ||
| @{ | ||
| id = $int++ | ||
| method = 'PATCH' | ||
| url = "users/$($User.userId)" | ||
| body = @{ | ||
| "$($Schema.id)" = $User.Properties | ||
| } | ||
| 'headers' = @{ | ||
| 'Content-Type' = 'application/json' | ||
| } | ||
| } | ||
| } | ||
|
|
||
| if ($PSCmdlet.ShouldProcess("User: $($Users.userId -join ', ')", 'Set Schema Properties')) { | ||
| $Requests = New-GraphBulkRequest -tenantid $tenantfilter -Requests @($Requests) | ||
| } | ||
| } |
Oops, something went wrong.