Skip to content

Commit c754b0a

Browse files
JohnDupreyJohnDuprey
authored
Merge pull request KelvinTegelaar#1051 from KelvinTegelaar/dev
Dev to hotfix
2 parents ebf0ca9 + 72ee84f commit c754b0a

127 files changed

Lines changed: 5770 additions & 353 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/dev_cipphfjdq.yml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
# Docs for the Azure Web Apps Deploy action: https://github.com/azure/functions-action
2+
# More GitHub Actions for Azure: https://github.com/Azure/actions
3+
4+
name: Build and deploy Powershell project to Azure Function App - cipphfjdq
5+
6+
on:
7+
push:
8+
branches:
9+
- dev
10+
workflow_dispatch:
11+
12+
env:
13+
AZURE_FUNCTIONAPP_PACKAGE_PATH: '.' # set this to the path to your web app project, defaults to the repository root
14+
15+
jobs:
16+
deploy:
17+
runs-on: windows-latest
18+
19+
steps:
20+
- name: 'Checkout GitHub Action'
21+
uses: actions/checkout@v4
22+
23+
- name: 'Run Azure Functions Action'
24+
uses: Azure/functions-action@v1
25+
id: fa
26+
with:
27+
app-name: 'cipphfjdq'
28+
slot-name: 'Production'
29+
package: ${{ env.AZURE_FUNCTIONAPP_PACKAGE_PATH }}
30+
publish-profile: ${{ secrets.AZUREAPPSERVICE_PUBLISHPROFILE_194504F3E0EE4941A2206C7E71DA4915 }}

‎.github/workflows/dev_cippopy3o.yml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
# Docs for the Azure Web Apps Deploy action: https://github.com/azure/functions-action
2+
# More GitHub Actions for Azure: https://github.com/Azure/actions
3+
4+
name: Build and deploy Powershell project to Azure Function App - cippopy3o
5+
6+
on:
7+
push:
8+
branches:
9+
- dev
10+
workflow_dispatch:
11+
12+
env:
13+
AZURE_FUNCTIONAPP_PACKAGE_PATH: '.' # set this to the path to your web app project, defaults to the repository root
14+
15+
jobs:
16+
deploy:
17+
runs-on: windows-latest
18+
19+
steps:
20+
- name: 'Checkout GitHub Action'
21+
uses: actions/checkout@v4
22+
23+
- name: 'Run Azure Functions Action'
24+
uses: Azure/functions-action@v1
25+
id: fa
26+
with:
27+
app-name: 'cippopy3o'
28+
slot-name: 'Production'
29+
package: ${{ env.AZURE_FUNCTIONAPP_PACKAGE_PATH }}
30+
publish-profile: ${{ secrets.AZUREAPPSERVICE_PUBLISHPROFILE_B5A7200CF39F4853A33349B80D54DC99 }}

‎Modules/CIPPCore/Public/Add-CIPPAzDataTableEntity.ps1‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -138,7 +138,7 @@ function Add-CIPPAzDataTableEntity {
138138
throw "Error processing entity: $ErrorMessage Linenumber: $($_.InvocationInfo.ScriptLineNumber)"
139139
}
140140
} else {
141-
Write-Information "THE ERROR IS $($_.Exception.ErrorCode). The size of the entity is $entitySize."
141+
Write-Information "THE ERROR IS $($_.Exception.message). The size of the entity is $entitySize."
142142
throw $_
143143
}
144144
}

‎Modules/CIPPCore/Public/Entrypoints/Activity Triggers/BPA/Push-BPACollectData.ps1‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,12 @@ function Push-BPACollectData {
1919
}
2020
}
2121
$Table = Get-CippTable -tablename 'cachebpav2'
22-
Write-Host "Working on BPA for $($TenantName.displayName) with GUID $($TenantName.customerId) - Report ID $($Item.Template)"
22+
$Rerun = Test-CIPPRerun -Type 'BPA' -Tenant $TenantName.defaultDomainName -API $Item.Template
23+
if ($Rerun) {
24+
Write-Host 'Detected rerun. Exiting cleanly'
25+
exit 0
26+
}
27+
Write-Host "Working on BPA for $($TenantName.defaultDomainName) with GUID $($TenantName.customerId) - Report ID $($Item.Template)"
2328
$Template = $Templates | Where-Object -Property Name -EQ -Value $Item.Template
2429
# Build up the result object that will be stored in tables
2530
$Result = @{

‎Modules/CIPPCore/Public/Entrypoints/Activity Triggers/Push-CIPPStandard.ps1‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,13 @@ function Push-CIPPStandard {
1212
$Standard = $Item.Standard
1313
$FunctionName = 'Invoke-CIPPStandard{0}' -f $Standard
1414
Write-Host "We'll be running $FunctionName"
15+
$Rerun = Test-CIPPRerun -Type Standard -Tenant $Tenant -Settings $Item.Settings -API $Standard
16+
if ($Rerun) {
17+
Write-Host 'Detected rerun. Exiting cleanly'
18+
exit 0
19+
} else {
20+
Write-Host "Rerun is set to false. We'll be running $FunctionName"
21+
}
1522
try {
1623
& $FunctionName -Tenant $Item.Tenant -Settings $Item.Settings -ErrorAction Stop
1724
} catch {

‎Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Extensions/Invoke-ExecExtensionsConfig.ps1‎

Lines changed: 17 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -17,21 +17,22 @@ Function Invoke-ExecExtensionsConfig {
1717
#Connect-AzAccount -UseDeviceAuthentication
1818
# Write to the Azure Functions log stream.
1919
Write-Information 'PowerShell HTTP trigger function processed a request.'
20+
$Body = [PSCustomObject]$Request.Body
2021
$results = try {
21-
if ($Request.Body.CIPPAPI.Enabled) {
22+
if ($Body.CIPPAPI.Enabled) {
2223
try {
23-
$APIConfig = New-CIPPAPIConfig -ExecutingUser $Request.Headers.'x-ms-client-principal' -resetpassword $Request.Body.CIPPAPI.ResetPassword
24+
$APIConfig = New-CIPPAPIConfig -ExecutingUser $Request.Headers.'x-ms-client-principal' -resetpassword $Body.CIPPAPI.ResetPassword
2425
$AddedText = $APIConfig.Results
2526
} catch {
2627
$AddedText = ' Could not enable CIPP-API. Check the CIPP documentation for API requirements.'
27-
$Request.Body = $Request.Body | Select-Object * -ExcludeProperty CIPPAPI
28+
$Body = $Body | Select-Object * -ExcludeProperty CIPPAPI
2829
}
2930
}
3031

3132
# Check if NinjaOne URL is set correctly and the instance has at least version 5.6
32-
if ($Request.Body.NinjaOne) {
33+
if ($Body.NinjaOne) {
3334
try {
34-
[version]$Version = (Invoke-WebRequest -Method GET -Uri "https://$(($Request.Body.NinjaOne.Instance -replace '/ws','') -replace 'https://','')/app-version.txt" -ea stop).content
35+
[version]$Version = (Invoke-WebRequest -Method GET -Uri "https://$(($Body.NinjaOne.Instance -replace '/ws','') -replace 'https://','')/app-version.txt" -ea stop).content
3536
} catch {
3637
throw "Failed to connect to NinjaOne check your Instance is set correctly eg 'app.ninjarmmm.com'"
3738
}
@@ -41,39 +42,39 @@ Function Invoke-ExecExtensionsConfig {
4142
}
4243

4344
$Table = Get-CIPPTable -TableName Extensionsconfig
44-
foreach ($APIKey in ([pscustomobject]$Request.Body).psobject.properties.name) {
45+
foreach ($APIKey in $Body.PSObject.Properties.Name) {
4546
Write-Information "Working on $apikey"
46-
if ($Request.Body.$APIKey.APIKey -eq 'SentToKeyVault' -or $Request.Body.$APIKey.APIKey -eq '') {
47+
if ($Body.$APIKey.APIKey -eq 'SentToKeyVault' -or $Body.$APIKey.APIKey -eq '') {
4748
Write-Information 'Not sending to keyvault. Key previously set or left blank.'
4849
} else {
4950
Write-Information 'writing API Key to keyvault, and clearing.'
5051
Write-Information "$ENV:WEBSITE_DEPLOYMENT_ID"
51-
if ($Request.Body.$APIKey.APIKey) {
52+
if ($Body.$APIKey.APIKey) {
5253
if ($env:AzureWebJobsStorage -eq 'UseDevelopmentStorage=true') {
5354
$DevSecretsTable = Get-CIPPTable -tablename 'DevSecrets'
5455
$Secret = [PSCustomObject]@{
5556
'PartitionKey' = $APIKey
5657
'RowKey' = $APIKey
57-
'APIKey' = $Request.Body.$APIKey.APIKey
58+
'APIKey' = $Body.$APIKey.APIKey
5859
}
5960
Add-CIPPAzDataTableEntity @DevSecretsTable -Entity $Secret -Force
6061
} else {
61-
$null = Set-AzKeyVaultSecret -VaultName $ENV:WEBSITE_DEPLOYMENT_ID -Name $APIKey -SecretValue (ConvertTo-SecureString -AsPlainText -Force -String $Request.Body.$APIKey.APIKey)
62+
$null = Set-AzKeyVaultSecret -VaultName $ENV:WEBSITE_DEPLOYMENT_ID -Name $APIKey -SecretValue (ConvertTo-SecureString -AsPlainText -Force -String $Body.$APIKey.APIKey)
6263
}
6364
}
64-
if ($Request.Body.$APIKey.PSObject.Properties -notcontains 'APIKey') {
65-
$Request.Body.$APIKey | Add-Member -MemberType NoteProperty -Name APIKey -Value 'SentToKeyVault'
65+
if ($Body.$APIKey.PSObject.Properties.Name -notcontains 'APIKey') {
66+
$Body.$APIKey | Add-Member -MemberType NoteProperty -Name APIKey -Value 'SentToKeyVault'
6667
} else {
67-
$Request.Body.$APIKey.APIKey = 'SentToKeyVault'
68+
$Body.$APIKey.APIKey = 'SentToKeyVault'
6869
}
6970
}
70-
$Request.Body.$APIKey = $Request.Body.$APIKey | Select-Object * -ExcludeProperty ResetPassword
71+
$Body.$APIKey = $Body.$APIKey | Select-Object * -ExcludeProperty ResetPassword
7172
}
72-
$body = $Request.Body | Select-Object * -ExcludeProperty APIKey, Enabled | ConvertTo-Json -Depth 10 -Compress
73+
$Body = $Body | Select-Object * -ExcludeProperty APIKey, Enabled | ConvertTo-Json -Depth 10 -Compress
7374
$Config = @{
7475
'PartitionKey' = 'CippExtensions'
7576
'RowKey' = 'Config'
76-
'config' = [string]$body
77+
'config' = [string]$Body
7778
}
7879

7980
Add-CIPPAzDataTableEntity @Table -Entity $Config -Force | Out-Null

‎Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecJITAdmin.ps1‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -136,7 +136,7 @@ Function Invoke-ExecJITAdmin {
136136
}
137137
}
138138

139-
$Parameters = @{
139+
$Parameters = [pscustomobject]@{
140140
TenantFilter = $Request.Body.TenantFilter
141141
User = @{
142142
'UserPrincipalName' = $Username

‎Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecPerUserMFAAllUsers.ps1‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
function Invoke-ExecPerUserMFAAllUsers {
2+
<#
3+
.FUNCTIONALITY
4+
Entrypoint
5+
6+
.ROLE
7+
Identity.User.ReadWrite
8+
#>
9+
Param(
10+
$Request,
11+
$TriggerMetadata
12+
)
13+
$TenantFilter = $request.query.TenantFilter
14+
$Users = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/users' -tenantid $TenantFilter
15+
$Request = @{
16+
userId = $Users.id
17+
TenantFilter = $tenantfilter
18+
State = $Request.query.State
19+
executingUser = $Request.Headers.'x-ms-client-principal'
20+
}
21+
$Result = Set-CIPPPerUserMFA @Request
22+
$Body = @{
23+
Results = @($Result)
24+
}
25+
Push-OutputBinding -Name Response -Value ([HttpResponseContext]@{
26+
StatusCode = [HttpStatusCode]::OK
27+
Body = $Body
28+
})
29+
}

‎Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecSendPush.ps1‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,7 @@ Function Invoke-ExecSendPush {
5252
$SPBody = [pscustomobject]@{
5353
appId = $MFAAppID
5454
}
55-
$SPID = (New-GraphPostRequest -uri 'https://graph.microsoft.com/v1.0/servicePrincipals' -tenantid $TenantFilter -type POST -body $SPBody -verbose).id
55+
$SPID = (New-GraphPostRequest -uri 'https://graph.microsoft.com/v1.0/servicePrincipals' -tenantid $TenantFilter -type POST -body $SPBody ).id
5656
}
5757

5858

@@ -64,7 +64,7 @@ Function Invoke-ExecSendPush {
6464
}
6565
} | ConvertTo-Json -Depth 5
6666

67-
$TempPass = (New-GraphPostRequest -uri "https://graph.microsoft.com/v1.0/servicePrincipals/$SPID/addPassword" -tenantid $TenantFilter -type POST -body $PassReqBody -verbose).secretText
67+
$TempPass = (New-GraphPostRequest -uri "https://graph.microsoft.com/v1.0/servicePrincipals/$SPID/addPassword" -tenantid $TenantFilter -type POST -body $PassReqBody -AsApp $true).secretText
6868

6969
# Give it a chance to apply
7070
#Start-Sleep 5

‎Modules/CIPPCore/Public/Get-CIPPMFAState.ps1‎

Lines changed: 20 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -17,20 +17,25 @@ function Get-CIPPMFAState {
1717
}
1818
}
1919

20-
$SecureDefaultsState = (New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/policies/identitySecurityDefaultsEnforcementPolicy' -tenantid $TenantFilter ).IsEnabled
20+
try {
21+
$SecureDefaultsState = (New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/policies/identitySecurityDefaultsEnforcementPolicy' -tenantid $TenantFilter ).IsEnabled
22+
} catch {
23+
Write-Host "Secure Defaults not available: $($_.Exception.Message)"
24+
}
2125
$CAState = [System.Collections.Generic.List[object]]::new()
2226

2327
Try {
24-
$MFARegistration = (New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/reports/credentialUserRegistrationDetails' -tenantid $TenantFilter)
28+
$MFARegistration = (New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/reports/authenticationMethods/userRegistrationDetails' -tenantid $TenantFilter)
2529
} catch {
2630
$CAState.Add('Not Licensed for Conditional Access') | Out-Null
2731
$MFARegistration = $null
32+
Write-Host "User registration details not available: $($_.Exception.Message)"
2833
}
2934

3035
if ($null -ne $MFARegistration) {
31-
$CAPolicies = (New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/identity/conditionalAccess/policies' -tenantid $TenantFilter -ErrorAction Stop )
32-
36+
$CASuccess = $true
3337
try {
38+
$CAPolicies = (New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/identity/conditionalAccess/policies' -tenantid $TenantFilter -ErrorAction Stop )
3439
foreach ($Policy in $CAPolicies) {
3540
$IsMFAControl = $policy.grantControls.builtincontrols -eq 'mfa' -or $Policy.grantControls.authenticationStrength.requirementsSatisfied -eq 'mfa' -or $Policy.grantControls.customAuthenticationFactors -eq 'RequireDuoMfa'
3641
$IsAllApps = [bool]($Policy.conditions.applications.includeApplications -eq 'All')
@@ -51,6 +56,8 @@ function Get-CIPPMFAState {
5156
}
5257
}
5358
} catch {
59+
$CASuccess = $false
60+
$CAError = "CA policies not available: $($_.Exception.Message)"
5461
}
5562
}
5663

@@ -59,7 +66,6 @@ function Get-CIPPMFAState {
5966

6067
# Interact with query parameters or the body of the request.
6168
$GraphRequest = $Users | ForEach-Object {
62-
Write-Host 'Processing users'
6369
$UserCAState = [System.Collections.Generic.List[object]]::new()
6470
foreach ($CA in $CAState) {
6571
if ($CA.IncludedUsers -eq 'All' -or $CA.IncludedUsers -contains $_.ObjectId) {
@@ -79,12 +85,16 @@ function Get-CIPPMFAState {
7985
$CoveredByCA = 'Enforced - Specific Apps'
8086
}
8187
} else {
82-
$CoveredByCA = 'Not Enforced'
88+
if ($CASuccess -eq $false) {
89+
$CoveredByCA = $CAError
90+
} else {
91+
$CoveredByCA = 'Not Enforced'
92+
}
8393
}
8494

8595
$PerUser = if ($PerUserMFAState -eq $null) { $null } else { ($PerUserMFAState | Where-Object -Property UserPrincipalName -EQ $_.UserPrincipalName).PerUserMFAState }
8696

87-
$MFARegUser = if (($MFARegistration | Where-Object -Property UserPrincipalName -EQ $_.UserPrincipalName).IsMFARegistered -eq $null) { $false } else { ($MFARegistration | Where-Object -Property UserPrincipalName -EQ $_.UserPrincipalName) }
97+
$MFARegUser = if (($MFARegistration | Where-Object -Property UserPrincipalName -EQ $_.userPrincipalName).isMFARegistered -eq $null) { $false } else { ($MFARegistration | Where-Object -Property UserPrincipalName -EQ $_.userPrincipalName) }
8898

8999
[PSCustomObject]@{
90100
Tenant = $TenantFilter
@@ -94,8 +104,9 @@ function Get-CIPPMFAState {
94104
AccountEnabled = $_.accountEnabled
95105
PerUser = $PerUser
96106
isLicensed = $_.isLicensed
97-
MFARegistration = $MFARegUser.IsMFARegistered
98-
MFAMethods = $MFARegUser.authMethods
107+
MFARegistration = $MFARegUser.isMFARegistered
108+
MFACapable = $MFARegUser.isMFACapable
109+
MFAMethods = $MFARegUser.methodsRegistered
99110
CoveredByCA = $CoveredByCA
100111
CAPolicies = $UserCAState
101112
CoveredBySD = $SecureDefaultsState

0 commit comments

Comments
 (0)